Analysis
-
max time kernel
0s -
max time network
1s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2023 15:48
Static task
static1
Behavioral task
behavioral1
Sample
dd6d5b77ea31de026c8bfb867f14ed70.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
dd6d5b77ea31de026c8bfb867f14ed70.dll
Resource
win10v2004-20231215-en
General
-
Target
dd6d5b77ea31de026c8bfb867f14ed70.dll
-
Size
38KB
-
MD5
dd6d5b77ea31de026c8bfb867f14ed70
-
SHA1
7865af12c34f87e095ff70812eb753cf3f944449
-
SHA256
553e833cf333ad707a9aa18e01f6d9d4fca8935b92f15c5ddfee379eabcb9efa
-
SHA512
45f361bd370f83d07de54f21ea1beacca8fe98e12a1051f37dc8e690481675d838620d3a2cca107007981b30795afe2240de0ffff58dc3265d8e259c0fe6b220
-
SSDEEP
768:tpB71V2b/CK1xbFHq4VPQz+oNOOs792CZ9xJS/DR1snrFqJknw/Agw:B1S/CMbFrVPQCoDC2CbxO91qrFqSnw4g
Malware Config
Signatures
-
Detect magniber ransomware 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3420-0-0x000001A8225E0000-0x000001A822B6B000-memory.dmp family_magniber -
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3420 rundll32.exe 3420 rundll32.exe