magniber | 4bf92967b0d2aabec0cb16f3c3792e714857db3e41ad5768e3493780b9342465

Analysis

max time kernel
0s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 07:12

Target

cd711f77c71b93a29494bba27afebb32.dll
Size

38KB
MD5

cd711f77c71b93a29494bba27afebb32
SHA1

a0d84f184191454e90d4bb2b7df52f8428a3b387
SHA256

4bf92967b0d2aabec0cb16f3c3792e714857db3e41ad5768e3493780b9342465
SHA512

5ad95f1fd3365a51d6438f054ecc7b849a3ef8197592403504e227402629b7b482e403e652aa0da36c7dd4f6733351639497c1de6d58df51876b906d7b261bec
SSDEEP

768:e04Jtvq/PbXsmSh5Mj13C05bRUSMI2mpKghGR5ZL4Z/DtChqYWrYBZF:MJtvupS/Mj13CAUTI2mpF85ZcZ/JSN

Score

10^/10

Detect magniber ransomware 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4832-15-0x000001D1D6510000-0x000001D1D6D53000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

4832 rundll32.exe

pid	process
4832	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd711f77c71b93a29494bba27afebb32.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4832

memory/2420-0-0x000002158BDC0000-0x000002158BDC4000-memory.dmp

Filesize
16KB

Download
memory/4832-15-0x000001D1D6510000-0x000001D1D6D53000-memory.dmp

Filesize
8.3MB

Download
memory/4832-20-0x000001D1D63E0000-0x000001D1D63E1000-memory.dmp

Filesize
4KB

Download
memory/4832-27-0x000001D1D6F20000-0x000001D1D6F21000-memory.dmp

Filesize
4KB

Download