075e16e48184e7d7f274ac7c8d7ff4c414844cc46b164fe7341aa38538653f1f

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 23:08

Target

075e16e48184e7d7f274ac7c8d7ff4c414844cc46b164fe7341aa38538653f1f.exe
Size

2.5MB
MD5

3e40c0169cf9cdadb9d3c0bd53a0ec6c
SHA1

aa2775bb08707961141eb4a941851859df3fe08c
SHA256

075e16e48184e7d7f274ac7c8d7ff4c414844cc46b164fe7341aa38538653f1f
SHA512

bf08c84b79529ecb6c871031ba9da45b39534da2d1937dc0f57ed6ad4eb3530081268d78668a80f07a3e8a8122366b924d9fc78a22d5ba4992a9cda700a26c48
SSDEEP

12288:AHfSe/YwjSFe5fEr7Lv5D91zGGgePNDKyhQtjWZh3r/TSz7cUOKqxoUihp4B/B:AHfSebjeAfEr7Lv5D91zGmUArg7aMp

Score

7^/10

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/1876-1-0x0000000000150000-0x00000000003CA000-memory.dmp	net_reactor

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2184	1876	075e16e48184e7d7f274ac7c8d7ff4c414844cc46b164fe7341aa38538653f1f.exe	31
PID 1876 wrote to memory of 2184	1876	075e16e48184e7d7f274ac7c8d7ff4c414844cc46b164fe7341aa38538653f1f.exe	31
PID 1876 wrote to memory of 2184	1876	075e16e48184e7d7f274ac7c8d7ff4c414844cc46b164fe7341aa38538653f1f.exe	31

C:\Users\Admin\AppData\Local\Temp\075e16e48184e7d7f274ac7c8d7ff4c414844cc46b164fe7341aa38538653f1f.exe
"C:\Users\Admin\AppData\Local\Temp\075e16e48184e7d7f274ac7c8d7ff4c414844cc46b164fe7341aa38538653f1f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1876 -s 628
  2⤵
  PID:2184

memory/1876-0-0x000007FEF6063000-0x000007FEF6064000-memory.dmp

Filesize
4KB

Download
memory/1876-1-0x0000000000150000-0x00000000003CA000-memory.dmp

Filesize
2.5MB

Download
memory/1876-4-0x000007FEF6060000-0x000007FEF6A4C000-memory.dmp

Filesize
9.9MB

Download
memory/1876-5-0x000007FEF6063000-0x000007FEF6064000-memory.dmp

Filesize
4KB

Download
memory/1876-6-0x000007FEF6060000-0x000007FEF6A4C000-memory.dmp

Filesize
9.9MB

Download