066ffe70bde0de3fe33830c21df0e774c9e0bdd8f80bbab66e04e0f28515b25f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 08:26

Target

2024-05-29_7681c73c5ff8b4fbd3b819e2b9deb317_magniber.exe
Size

4.3MB
MD5

7681c73c5ff8b4fbd3b819e2b9deb317
SHA1

a4a6a95a404a2b0792ff965a32e2e77eda71f584
SHA256

066ffe70bde0de3fe33830c21df0e774c9e0bdd8f80bbab66e04e0f28515b25f
SHA512

ae1bb0e15cd146af505ead08fd100009afd671f7c302e37a84ba15b440a26e072538eb8cc515ce8f0843a84f6a624cf13c5cb02f1c30e5264b4009ad7557b7ba
SSDEEP

49152:4NuHufKpHxUll250VZ/HmLKTVrbGlGF6ApG6JX1fHqT5H5eMzLJctPl9N0p3pVuY:4NuHVHClJxGLsZGlGFHqT5H3Jc3uD

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/memory/2932-0-0x0000000000BC0000-0x0000000001005000-memory.dmp	UPX
behavioral1/memory/2932-1-0x0000000000BC0000-0x0000000001005000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2932-0-0x0000000000BC0000-0x0000000001005000-memory.dmp	upx
behavioral1/memory/2932-1-0x0000000000BC0000-0x0000000001005000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2380	2932	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2380	2932	2024-05-29_7681c73c5ff8b4fbd3b819e2b9deb317_magniber.exe	28
PID 2932 wrote to memory of 2380	2932	2024-05-29_7681c73c5ff8b4fbd3b819e2b9deb317_magniber.exe	28
PID 2932 wrote to memory of 2380	2932	2024-05-29_7681c73c5ff8b4fbd3b819e2b9deb317_magniber.exe	28
PID 2932 wrote to memory of 2380	2932	2024-05-29_7681c73c5ff8b4fbd3b819e2b9deb317_magniber.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-29_7681c73c5ff8b4fbd3b819e2b9deb317_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-29_7681c73c5ff8b4fbd3b819e2b9deb317_magniber.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 104
  2⤵
  - Program crash
  PID:2380

memory/2932-0-0x0000000000BC0000-0x0000000001005000-memory.dmp

Filesize
4.3MB

Download
memory/2932-1-0x0000000000BC0000-0x0000000001005000-memory.dmp

Filesize
4.3MB

Download