Getting OutOfMemory Exceptions for C# applications when injection enabled (on Windows 10)

[Clevero]

My issue is:

Getting "OutOfMemory" Exception when submitting C# samples Submitted a ransomware that is renaming files and also a simple hello world console application. Both are raising the exception before anything is really done by the application Tried to catch the exception, but it seems to me that the catch block is not really executed after raising the exception

My Cuckoo version and operating system are:

Cuckoo 2.0.6 on Ubuntu 16.0.4

This can be reproduced by:

Submitting both .exe samples with injection enabled (via web interface)

What did you try to do so far?:

Disabling injection via web interface. After doing so, each sample was executed as expected

The log, error, files etc can be found at:

• Files:

  • ransomware: Adds_.wToFilenamesOnDesktop.exe.zip | Source Code
  • Hello World: ConsoleApp2.zip | Source Code

• Injection enabled

  • ransomware: 30.zip
  • Hello World: 31.zip

• Injection disabled

  • ransomware: 32.zip (too big for GitHub -> nextcloud share)
  • Hello World: 33.zip

[RicoVZ]

Hi Clevero,

Thanks for posting an issue. :smile:

Could you provide us with the the following things:

• The analysis VM operating system
• The .NET version(s) installed on the VM
• The amount of RAM your VM has

These details could help us reproduce the error and determine what might be causing this. I will try to reproduce it when I find some time.

[Clevero]

Sorry that I forgot that

• VM OS: Windows 10, Build 10586 (hope that this isn't the problem)
• Installed .NET Version: 4.0 Edit: actually 4.7.2 is installed
• RAM: 8GB (mostly not used. Task Manager shows ~20% usage according to the screenshots in the exported reports)

[Clevero]

I've retested it with a Windows 7 vm and it works with Injection enabled

Setup:

• Windows 7 Professional 64Bit Service Pack 1
• .NET: 4.7.2
• RAM: 8GB

analysis report (too big for GitHub -> nextcloud)

Need to correct me, on Windows 10 it was also .Net 4.7.2 installed

[RicoVZ]

@Clevero Thanks for the update! :smile:

Windows 10 is still on our list of improvements. We recommend to use Windows 7 (as you did). To be sure: your issue does not occur on the Windows 7 machine?