fc013f78af73ba7380f52d55e7eb36389807d9f278e75117d08d4621f03922ff

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 19:36

Target

2024-02-04_9b81ca6c057fd6194e34b37418fa201b_ryuk.exe
Size

139KB
MD5

9b81ca6c057fd6194e34b37418fa201b
SHA1

ade38199506e56393c5c36d5c580249fa6a296c5
SHA256

fc013f78af73ba7380f52d55e7eb36389807d9f278e75117d08d4621f03922ff
SHA512

41fd5bd5cde703ecf58dc00972b29a495838ea6b2b816d18bfe2f68342ff1785a7bde7728912083d8c7a3d318f6ae0fbd02d0ab6e2145416b26ba7cb009e7dda
SSDEEP

3072:TyTZXYw/VAJJhxN4noPgEu8iET8ymDHYS2Lvblv:TG/UJh8GNZi5ymED

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 2724	116	2024-02-04_9b81ca6c057fd6194e34b37418fa201b_ryuk.exe	89
PID 116 wrote to memory of 2724	116	2024-02-04_9b81ca6c057fd6194e34b37418fa201b_ryuk.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-02-04_9b81ca6c057fd6194e34b37418fa201b_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-04_9b81ca6c057fd6194e34b37418fa201b_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c
  2⤵
  PID:2724