f6019ee1d105573df4f8bf34296249ef5165f5b01bab4aae9d7208debade1753

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 21:46

Target

2024-01-23_7ff8f563d4922ce46314d304e0b31ebd_cobalt-strike_ryuk.exe
Size

620KB
MD5

7ff8f563d4922ce46314d304e0b31ebd
SHA1

268cac6731adfd5d6405e8efd2c0b0aed14a941c
SHA256

f6019ee1d105573df4f8bf34296249ef5165f5b01bab4aae9d7208debade1753
SHA512

534841b068f42bcbed4aaa96d32626b9e9917c8df9cea7f13f279bccd4dbb48c222b4eb97df742faf9fe1859ecf851a89ba07c2e33f1fe6dbe7c9f654c9ad2b9
SSDEEP

12288:mAv8NdYRpQqoWLfmUzM9HtQEroCqOBbMjXpVO:mAv1ZfmM5ALqOWbp4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2888	2932	2024-01-23_7ff8f563d4922ce46314d304e0b31ebd_cobalt-strike_ryuk.exe	28
PID 2932 wrote to memory of 2888	2932	2024-01-23_7ff8f563d4922ce46314d304e0b31ebd_cobalt-strike_ryuk.exe	28
PID 2932 wrote to memory of 2888	2932	2024-01-23_7ff8f563d4922ce46314d304e0b31ebd_cobalt-strike_ryuk.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-23_7ff8f563d4922ce46314d304e0b31ebd_cobalt-strike_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-23_7ff8f563d4922ce46314d304e0b31ebd_cobalt-strike_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2932 -s 148
  2⤵
  PID:2888