534baf68b23474fd41c2320b64ccc61ba0a2cda9cf7539dcaac1cadfb61ddb76

Analysis

max time kernel
120s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 11:27

Target

Coolex.exe
Size

592KB
MD5

13034953bfef0f62b56f8da9c0241f05
SHA1

dc285a3549675369b0bd63b1490eedcdc3fa620c
SHA256

c3713f9104b664abe8712c35436c1bb02319017b6c8c7d27fce95b9cf54e1bed
SHA512

3b6b18685737acf20279f2d26b5d89f852958a46ce33214863b65a86fdc380a287ea2814afc7e9d06e366cd76eaf6a1328e3fda08ed21b19fbae088ec6d278da
SSDEEP

6144:8WG0YFxMEm0ip2amaatclQaRHU03jg9rT77HU03jg9rTV:83ZMH042tkR003UpX7003Upp

Score

7^/10

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral11/memory/2808-1-0x00000000008C0000-0x0000000000958000-memory.dmp	net_reactor

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2748	2808	Coolex.exe	30
PID 2808 wrote to memory of 2748	2808	Coolex.exe	30
PID 2808 wrote to memory of 2748	2808	Coolex.exe	30

C:\Users\Admin\AppData\Local\Temp\Coolex.exe
"C:\Users\Admin\AppData\Local\Temp\Coolex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2808 -s 620
  2⤵
  PID:2748

memory/2808-0-0x000007FEF50B3000-0x000007FEF50B4000-memory.dmp

Filesize
4KB

Download
memory/2808-1-0x00000000008C0000-0x0000000000958000-memory.dmp

Filesize
608KB

Download
memory/2808-2-0x00000000008B0000-0x00000000008BE000-memory.dmp

Filesize
56KB

Download
memory/2808-3-0x000000001CC50000-0x000000001D8E8000-memory.dmp

Filesize
12.6MB

Download
memory/2808-4-0x000007FEF50B3000-0x000007FEF50B4000-memory.dmp

Filesize
4KB

Download