e3834a2cca58589cd5ae7b74554bdeb7b034c3e9c20a242bda50630c085b7b08

Analysis

max time kernel
8s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe
Size

65.3MB
MD5

4c5e7e03b3340f8f7892ee3d42e9a38e
SHA1

79e9ec593dc4cd7acaccd64e788c6e602777a5a9
SHA256

e3834a2cca58589cd5ae7b74554bdeb7b034c3e9c20a242bda50630c085b7b08
SHA512

308e9a145ebe8fb6afcb10f0cdf15762ab8b886b0facf39e86b73547b33152117e2ec77a05f0808cccc5c4846735ef79025104934fe87aafd1415ca6c85fb79d
SSDEEP

1572864:TzCuDCsDez886B2W9+b3AJdh8viKn95fnGT:TzCuMz886Lkb3MhFKnnfk

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2580	1848	WerFault.exe	29

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2296	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	30
PID 1848 wrote to memory of 2296	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	30
PID 1848 wrote to memory of 2296	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	30
PID 1848 wrote to memory of 2296	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	30
PID 1848 wrote to memory of 2976	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	32
PID 1848 wrote to memory of 2976	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	32
PID 1848 wrote to memory of 2976	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	32
PID 1848 wrote to memory of 2976	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	32
PID 1848 wrote to memory of 1836	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	34
PID 1848 wrote to memory of 1836	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	34
PID 1848 wrote to memory of 1836	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	34
PID 1848 wrote to memory of 1836	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	34
PID 1848 wrote to memory of 2696	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	36
PID 1848 wrote to memory of 2696	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	36
PID 1848 wrote to memory of 2696	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	36
PID 1848 wrote to memory of 2696	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	36
PID 1848 wrote to memory of 2784	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	38
PID 1848 wrote to memory of 2784	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	38
PID 1848 wrote to memory of 2784	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	38
PID 1848 wrote to memory of 2784	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	38
PID 1848 wrote to memory of 2580	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	41
PID 1848 wrote to memory of 2580	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	41
PID 1848 wrote to memory of 2580	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	41
PID 1848 wrote to memory of 2580	1848	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	41

C:\Users\Admin\AppData\Local\Temp\2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\system32\logman.exe" create trace SentinelOneInstallerLogEtwSession_B98C9E3EF1B04A50B2A7B420B0ED081A -o C:\Windows\Temp\SentinelOneInstallerLog_B98C9E3_2024_07_04_22_49_57.etl -max 200 -ets
  2⤵
  PID:2296
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\system32\logman.exe" update trace SentinelOneInstallerLogEtwSession_B98C9E3EF1B04A50B2A7B420B0ED081A -p {1D886617-AA23-4A85-8B9C-80574C5B67E7} -ets
  2⤵
  PID:2976
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\system32\logman.exe" update trace SentinelOneInstallerLogEtwSession_B98C9E3EF1B04A50B2A7B420B0ED081A -p {0B694327-369B-4B22-94EA-D1B82E68CE53} -ets
  2⤵
  PID:1836
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\system32\logman.exe" update trace SentinelOneInstallerLogEtwSession_B98C9E3EF1B04A50B2A7B420B0ED081A -p {F0DDEC44-F423-4CC3-ADD7-89C36719E40A} -ets
  2⤵
  PID:2696
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\system32\logman.exe" update trace SentinelOneInstallerLogEtwSession_B98C9E3EF1B04A50B2A7B420B0ED081A -p {1B30854F-A52D-4808-A919-BF52C14DC264} -ets
  2⤵
  PID:2784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 380
  2⤵
  - Program crash
  PID:2580

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads