e3834a2cca58589cd5ae7b74554bdeb7b034c3e9c20a242bda50630c085b7b08

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 22:47

Target

2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe
Size

65.3MB
MD5

4c5e7e03b3340f8f7892ee3d42e9a38e
SHA1

79e9ec593dc4cd7acaccd64e788c6e602777a5a9
SHA256

e3834a2cca58589cd5ae7b74554bdeb7b034c3e9c20a242bda50630c085b7b08
SHA512

308e9a145ebe8fb6afcb10f0cdf15762ab8b886b0facf39e86b73547b33152117e2ec77a05f0808cccc5c4846735ef79025104934fe87aafd1415ca6c85fb79d
SSDEEP

1572864:TzCuDCsDez886B2W9+b3AJdh8viKn95fnGT:TzCuMz886Lkb3MhFKnnfk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1732	4208	WerFault.exe	80

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 1352	4208	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	81
PID 4208 wrote to memory of 1352	4208	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	81
PID 4208 wrote to memory of 1352	4208	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	81
PID 4208 wrote to memory of 1564	4208	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	83
PID 4208 wrote to memory of 1564	4208	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	83
PID 4208 wrote to memory of 1564	4208	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	83
PID 4208 wrote to memory of 4680	4208	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	85
PID 4208 wrote to memory of 4680	4208	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	85
PID 4208 wrote to memory of 4680	4208	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	85
PID 4208 wrote to memory of 3948	4208	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	87
PID 4208 wrote to memory of 3948	4208	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	87
PID 4208 wrote to memory of 3948	4208	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	87
PID 4208 wrote to memory of 2924	4208	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	89
PID 4208 wrote to memory of 2924	4208	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	89
PID 4208 wrote to memory of 2924	4208	2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-04_4c5e7e03b3340f8f7892ee3d42e9a38e_magniber.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\system32\logman.exe" create trace SentinelOneInstallerLogEtwSession_E7CE8FC6231A4362B4B93688D0A26FCC -o C:\Windows\Temp\SentinelOneInstallerLog_E7CE8FC_2024_07_04_22_48_00.etl -max 200 -ets
  2⤵
  PID:1352
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\system32\logman.exe" update trace SentinelOneInstallerLogEtwSession_E7CE8FC6231A4362B4B93688D0A26FCC -p {1D886617-AA23-4A85-8B9C-80574C5B67E7} -ets
  2⤵
  PID:1564
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\system32\logman.exe" update trace SentinelOneInstallerLogEtwSession_E7CE8FC6231A4362B4B93688D0A26FCC -p {0B694327-369B-4B22-94EA-D1B82E68CE53} -ets
  2⤵
  PID:4680
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\system32\logman.exe" update trace SentinelOneInstallerLogEtwSession_E7CE8FC6231A4362B4B93688D0A26FCC -p {F0DDEC44-F423-4CC3-ADD7-89C36719E40A} -ets
  2⤵
  PID:3948
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\system32\logman.exe" update trace SentinelOneInstallerLogEtwSession_E7CE8FC6231A4362B4B93688D0A26FCC -p {1B30854F-A52D-4808-A919-BF52C14DC264} -ets
  2⤵
  PID:2924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 748
  2⤵
  - Program crash
  PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4208 -ip 4208
1⤵
PID:2028