magniber | fd4a482cc2d1469c31a4bed466d4acf717ecaa83af1abd677198d254ee25bf22

Analysis

max time kernel
0s
max time network
25s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2023 07:58

Target

7b598815af2522938f6bc3fb53010cc0.dll
Size

38KB
MD5

7b598815af2522938f6bc3fb53010cc0
SHA1

76b6d116179c3cd38f1b715fe1778290eb87c676
SHA256

fd4a482cc2d1469c31a4bed466d4acf717ecaa83af1abd677198d254ee25bf22
SHA512

5e3fe2689dd31b1c488256f332c829bab3e97ba89fba020a423130af13657e21341514d38f7cc33a636e47fb07294083d351d09c7887c4792fc0f1026523210a
SSDEEP

768:B51I4cnvHkMeaEIwCrbjvkTlmx3El3xF00ydemHlTfLIt3GeMdE:31Ix/eaZwCXjvY5/F7ygmRfLIt3GFE

Score

10^/10

Detect magniber ransomware 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4416-0-0x00000284234A0000-0x0000028423D24000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Suspicious use of SetThreadContext 5 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 4416 set thread context of 3004	4416	rundll32.exe	46
PID 4416 set thread context of 3068	4416	rundll32.exe	45
PID 4416 set thread context of 2724	4416	rundll32.exe	44
PID 4416 set thread context of 3432	4416	rundll32.exe	40
PID 4416 set thread context of 3548	4416	rundll32.exe	39

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid	Process
4416	rundll32.exe
4416	rundll32.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

rundll32.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3548

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3068

memory/3004-5-0x000001F4885C0000-0x000001F4885C5000-memory.dmp

Filesize
20KB

Download
memory/4416-8-0x0000028423D60000-0x0000028423D61000-memory.dmp

Filesize
4KB

Download
memory/4416-2-0x0000028423480000-0x0000028423481000-memory.dmp

Filesize
4KB

Download
memory/4416-3-0x0000028423D30000-0x0000028423D31000-memory.dmp

Filesize
4KB

Download
memory/4416-4-0x0000028423D40000-0x0000028423D41000-memory.dmp

Filesize
4KB

Download
memory/4416-1-0x0000028423470000-0x0000028423471000-memory.dmp

Filesize
4KB

Download
memory/4416-0-0x00000284234A0000-0x0000028423D24000-memory.dmp

Filesize
8.5MB

Download
memory/4416-6-0x0000028423D50000-0x0000028423D51000-memory.dmp

Filesize
4KB

Download
memory/4416-9-0x0000028423D70000-0x0000028423D71000-memory.dmp

Filesize
4KB

Download
memory/4416-11-0x0000028423DB0000-0x0000028423DB1000-memory.dmp

Filesize
4KB

Download
memory/4416-12-0x0000028423DC0000-0x0000028423DC1000-memory.dmp

Filesize
4KB

Download
memory/4416-13-0x0000028423DD0000-0x0000028423DD1000-memory.dmp

Filesize
4KB

Download
memory/4416-14-0x0000028423DE0000-0x0000028423DE1000-memory.dmp

Filesize
4KB

Download