bea52432905bab98832d4cb31939dc5d8ed3c5327654bd9eef320cb7742f654b

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
06/11/2023, 20:44

Target

NEAS.2023-09-29_89b004c7fd22ee3c694b442b83eca3c5_ryuk.exe
Size

9.4MB
MD5

89b004c7fd22ee3c694b442b83eca3c5
SHA1

663af89d077684000c2e9301e28eae1ba076b653
SHA256

bea52432905bab98832d4cb31939dc5d8ed3c5327654bd9eef320cb7742f654b
SHA512

29e2d902acbcc7203ba1a231ff799e68085079eeecec5dbf36663bbaf980f6c39b76f5e67683b0507cf72fa67b42104251b0c99fa3342dab30bedd599fde7923
SSDEEP

196608:YS4P+GIxr9onJ5hrZERlyiU8AdZYJERS48RmU/3ZlsPvarTJQg8C3T2Lqb56:bPt9c5hlERJAdZYygtN3ZWar9RTk

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
304	NEAS.2023-09-29_89b004c7fd22ee3c694b442b83eca3c5_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 304	1516	NEAS.2023-09-29_89b004c7fd22ee3c694b442b83eca3c5_ryuk.exe	29
PID 1516 wrote to memory of 304	1516	NEAS.2023-09-29_89b004c7fd22ee3c694b442b83eca3c5_ryuk.exe	29
PID 1516 wrote to memory of 304	1516	NEAS.2023-09-29_89b004c7fd22ee3c694b442b83eca3c5_ryuk.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-29_89b004c7fd22ee3c694b442b83eca3c5_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-29_89b004c7fd22ee3c694b442b83eca3c5_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-29_89b004c7fd22ee3c694b442b83eca3c5_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-29_89b004c7fd22ee3c694b442b83eca3c5_ryuk.exe"
  2⤵
  - Loads dropped DLL
  PID:304

C:\Users\Admin\AppData\Local\Temp\_MEI15162\Calculadora-Obfuscated.exe.manifest

Filesize
1KB

MD5
4357d96c0b2f23798e58e78e4d8bd8e0

SHA1
326d0c781992a0826405cd5851f7e7b9a155abc0

SHA256
88a6715840b58a1aa768b01be38e6dfc7baa6e678fff42e6f59ecca60adf8f1f

SHA512
9538815f9bc7c27e83a42ee200d827542360190f993c30e7472c8d1c8a3b07bceb8e64ab767639aa1ed8b0c3ea379237ebed53b1a8ad2f4057de53cb5c6bc6fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15162\python39.dll

Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15162\python39.dll

Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit