e9e6a5e4d64f01b158801bbaead6aedfeeb8cd754e734d1471f591ca3e2c08f8

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:17

Target

db0b5b8185efd6ca7c3f569aec811ea6.exe
Size

5.6MB
MD5

db0b5b8185efd6ca7c3f569aec811ea6
SHA1

9b4c4966684020b351943b44bb3be066e23f2ccb
SHA256

d2b0f426014687a310ac74bfe78da227f506d163d6635527d115c0b96b5d0ab4
SHA512

891b19ba225e729d691906a5a3765c248a130c562cb587fe2fee507fd78a2f585e13d851ab23b32bbeed3f87d01cd2f2d50fde9ceaaffbc12f2de6e20f96408b
SSDEEP

98304:OvGBBkxCZS9bYZhID0qLNYfeW+4IkRpKMzVUp6QRDy:aGBBJDhID0qLNY64BR0MzVUp6QRDy

Score

7^/10

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral25/memory/2864-1-0x00000000012C0000-0x0000000001860000-memory.dmp	net_reactor
behavioral25/memory/2676-5-0x0000000002350000-0x000000000238A000-memory.dmp	net_reactor
behavioral25/files/0x000500000001a400-4.dat	net_reactor

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2676	2864	db0b5b8185efd6ca7c3f569aec811ea6.exe	30
PID 2864 wrote to memory of 2676	2864	db0b5b8185efd6ca7c3f569aec811ea6.exe	30
PID 2864 wrote to memory of 2676	2864	db0b5b8185efd6ca7c3f569aec811ea6.exe	30

C:\Users\Admin\AppData\Local\Temp\db0b5b8185efd6ca7c3f569aec811ea6.exe
"C:\Users\Admin\AppData\Local\Temp\db0b5b8185efd6ca7c3f569aec811ea6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /U "C:\Users\Admin\AppData\Roaming\LoaderV4\LoaderV4\1.0.0.0\RegsvcsRegasm X64.dll"
  2⤵
  PID:2676

C:\Users\Admin\AppData\Roaming\LoaderV4\LoaderV4\1.0.0.0\RegsvcsRegasm X64.dll

Filesize
207KB

MD5
06d5f500105e6dd6d423080dfbe915e4

SHA1
8bf682233a063fd93c9d5cc7bdfdc93a9e473beb

SHA256
b27fa76d324d61489e0245a4373e2704627f8f006d6797cfbba70c5aa5fbdb47

SHA512
b70ebb02d4a751adc82184fd97e337c371178f663e7e14197f97ea2954ffa766bf2bfe5dc5e999fbed6c885e9a8cd8d474cb082e3dd96bb7281f7a5c5441dd08

Download Submit
memory/2676-3-0x000000013F7A0000-0x000000013F7B0000-memory.dmp

Filesize
64KB

Download
memory/2676-5-0x0000000002350000-0x000000000238A000-memory.dmp

Filesize
232KB

Download
memory/2864-0-0x000007FEF6383000-0x000007FEF6384000-memory.dmp

Filesize
4KB

Download
memory/2864-1-0x00000000012C0000-0x0000000001860000-memory.dmp

Filesize
5.6MB

Download