b39f3c1533ff0a817a221ec313c11b926dfcc1b0e3a3a49fea5cb3151b094ee3

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-02-2024 09:51

Target

tmp.exe
Size

595KB
MD5

2060ab69656588e8acefcde9c7cc0a5f
SHA1

f4501b82e348b38cf4f877bff1c1447828585c6a
SHA256

b39f3c1533ff0a817a221ec313c11b926dfcc1b0e3a3a49fea5cb3151b094ee3
SHA512

10f3447e6cd5a065184395368825030951c62e6c59f980399f832b0862ae09d8db20b7557c4b25917ca78c92750dfb9654e5064fc860a5a6abff198574fa6573
SSDEEP

12288:ih1Fk70TnvjcWYbRQsBTNcHG2k+Nfw3HtUZwi+rRvoR9yrc4+GX:Mk70TrcWYbmsBxN2otUf+Yyrc0X

Score

7^/10

.NET Reactor proctector 4 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/1320-0-0x0000000004920000-0x000000000499E000-memory.dmp	net_reactor
behavioral1/memory/1320-5-0x0000000004B30000-0x0000000004BAC000-memory.dmp	net_reactor
behavioral1/memory/1320-10-0x00000000049F0000-0x0000000004A30000-memory.dmp	net_reactor
behavioral1/memory/1320-11-0x00000000049F0000-0x0000000004A30000-memory.dmp	net_reactor

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2996 1320 WerFault.exe tmp.exe

pid	pid_target	process	target process
2996	1320	WerFault.exe	tmp.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 1320 wrote to memory of 2996	1320	tmp.exe	WerFault.exe
PID 1320 wrote to memory of 2996	1320	tmp.exe	WerFault.exe
PID 1320 wrote to memory of 2996	1320	tmp.exe	WerFault.exe
PID 1320 wrote to memory of 2996	1320	tmp.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 600
  2⤵
  - Program crash
  PID:2996

memory/1320-0-0x0000000004920000-0x000000000499E000-memory.dmp

Filesize
504KB

Download
memory/1320-1-0x0000000074490000-0x0000000074B7E000-memory.dmp

Filesize
6.9MB

Download
memory/1320-3-0x00000000049F0000-0x0000000004A30000-memory.dmp

Filesize
256KB

Download
memory/1320-2-0x00000000049F0000-0x0000000004A30000-memory.dmp

Filesize
256KB

Download
memory/1320-4-0x00000000049F0000-0x0000000004A30000-memory.dmp

Filesize
256KB

Download
memory/1320-5-0x0000000004B30000-0x0000000004BAC000-memory.dmp

Filesize
496KB

Download
memory/1320-8-0x00000000023B0000-0x00000000043B0000-memory.dmp

Filesize
32.0MB

Download
memory/1320-9-0x0000000074490000-0x0000000074B7E000-memory.dmp

Filesize
6.9MB

Download
memory/1320-10-0x00000000049F0000-0x0000000004A30000-memory.dmp

Filesize
256KB

Download
memory/1320-11-0x00000000049F0000-0x0000000004A30000-memory.dmp

Filesize
256KB

Download
memory/1320-12-0x00000000023B0000-0x00000000043B0000-memory.dmp

Filesize
32.0MB

Download