Analysis
-
max time kernel
0s -
max time network
23s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
25-02-2024 13:29
General
-
Target
a3e7152abd213f303c1561aa20ed9cea.dll
-
Size
38KB
-
MD5
a3e7152abd213f303c1561aa20ed9cea
-
SHA1
0cfb6ac5f567c4dd3e9ebe741c2b8b0e19cb243e
-
SHA256
8ab78bc8884b9de573a3dc19e7fc206e925f643aee3f152d19e8d1caa90b6312
-
SHA512
854dad9d639cb4c9860c7dcd2d1bb7204ce3efe0a5bc0521d37a61e7ef3787a8334620d718ec2abdbbd077122c008273ce29cf1382af45d8411c431f5cf2e777
-
SSDEEP
768:bL2WWrr4WdC5pqndJgr8q39GGL3RqL9Q1VW028JQyt3uh11yCg:GdC5pqndJIHtGCE9Q1rRxIM
Score
10/10
Malware Config
Signatures
-
Detect magniber ransomware 1 IoCs
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Suspicious use of SetThreadContext 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3e7152abd213f303c1561aa20ed9cea.dll,#11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
-
Filesize
6.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB