cae5d1df4e948b813a01bb83d087b6438d91a1aeb3f6a0a16a328373edfe851d

Analysis

max time kernel
141s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 03:24

Target

cae5d1df4e948b813a01bb83d087b6438d91a1aeb3f6a0a16a328373edfe851d.exe
Size

1.3MB
MD5

2f3c519c599dc02d11bf57918b798ee3
SHA1

82ad01ac3e2cdb9d795cf6d7ab2ae3d3a417843a
SHA256

cae5d1df4e948b813a01bb83d087b6438d91a1aeb3f6a0a16a328373edfe851d
SHA512

c2d6016c9bae5d5bf41583a5f2de54f8e8a0effd6a3af97a6259ab73b23a505e15f0c96df6b82dbba40d3b9562ebb5a5e42961088b123433bede257e6c4e8f06
SSDEEP

24576:AcB8ggg0szL2dMVBQwv4XOylc6foK1thFMyd:fB8gggj04vZyC6wKR

Score

9^/10

Detects executables packed with unregistered version of .NET Reactor 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4156-1-0x0000000000040000-0x000000000016A000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral2/memory/4156-1-0x0000000000040000-0x000000000016A000-memory.dmp	net_reactor

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cae5d1df4e948b813a01bb83d087b6438d91a1aeb3f6a0a16a328373edfe851d.exe

description pid process

Token: SeDebugPrivilege 4156 cae5d1df4e948b813a01bb83d087b6438d91a1aeb3f6a0a16a328373edfe851d.exe

description	pid	process
Token: SeDebugPrivilege	4156	cae5d1df4e948b813a01bb83d087b6438d91a1aeb3f6a0a16a328373edfe851d.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cae5d1df4e948b813a01bb83d087b6438d91a1aeb3f6a0a16a328373edfe851d.exe

description	pid	process	target process
PID 4156 wrote to memory of 3104	4156	cae5d1df4e948b813a01bb83d087b6438d91a1aeb3f6a0a16a328373edfe851d.exe	cae5d1df4e948b813a01bb83d087b6438d91a1aeb3f6a0a16a328373edfe851d.exe
PID 4156 wrote to memory of 3104	4156	cae5d1df4e948b813a01bb83d087b6438d91a1aeb3f6a0a16a328373edfe851d.exe	cae5d1df4e948b813a01bb83d087b6438d91a1aeb3f6a0a16a328373edfe851d.exe
PID 4156 wrote to memory of 3104	4156	cae5d1df4e948b813a01bb83d087b6438d91a1aeb3f6a0a16a328373edfe851d.exe	cae5d1df4e948b813a01bb83d087b6438d91a1aeb3f6a0a16a328373edfe851d.exe

C:\Users\Admin\AppData\Local\Temp\cae5d1df4e948b813a01bb83d087b6438d91a1aeb3f6a0a16a328373edfe851d.exe
C:\Users\Admin\AppData\Local\Temp\cae5d1df4e948b813a01bb83d087b6438d91a1aeb3f6a0a16a328373edfe851d.exe
2⤵
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:2504

memory/4156-0-0x000000007529E000-0x000000007529F000-memory.dmp

Filesize
4KB

Download
memory/4156-1-0x0000000000040000-0x000000000016A000-memory.dmp

Filesize
1.2MB

Download
memory/4156-2-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/4156-3-0x0000000004B80000-0x0000000004C1C000-memory.dmp

Filesize
624KB

Download
memory/4156-4-0x0000000005370000-0x0000000005914000-memory.dmp

Filesize
5.6MB

Download
memory/4156-5-0x0000000004B70000-0x0000000004B7A000-memory.dmp

Filesize
40KB

Download
memory/4156-8-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/4156-11-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/4156-13-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download