Analysis

  • max time kernel
    122s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19/02/2024, 01:56

General

  • Target

    Ruination.exe

  • Size

    190.7MB

  • MD5

    0131e11340038bf840bbd66f65416ed6

  • SHA1

    584a359bd3cf197130c67ea938202cbf93f22d3d

  • SHA256

    5796b2df0c516445c2084a16dbf7ce20e4c4ace73712fec9f88062b9273f003d

  • SHA512

    5b737eb29ac13dd9a0c78f559b97f18b2736c1e9be7bc3555d0bfe8f00a4454942787e7f0fbc07034557abaa39eebadf0abffd6213a40f197c7ee5a6a556e2f6

  • SSDEEP

    1572864:8a2LVb7D/6jCWf81YfMaXArlEU01tVj5O:8aGVPejZMaX4EU01tVjk

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ruination.exe
    "C:\Users\Admin\AppData\Local\Temp\Ruination.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2696
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2696 -s 680
      2⤵
        PID:2988

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2696-0-0x0000000003320000-0x0000000003E40000-memory.dmp

            Filesize

            11.1MB

          • memory/2696-5-0x000000013FC90000-0x00000001405C2000-memory.dmp

            Filesize

            9.2MB

          • memory/2696-4-0x0000000004F80000-0x0000000005F00000-memory.dmp

            Filesize

            15.5MB

          • memory/2696-9-0x0000000006140000-0x0000000006370000-memory.dmp

            Filesize

            2.2MB

          • memory/2696-13-0x00000000020C0000-0x0000000002220000-memory.dmp

            Filesize

            1.4MB

          • memory/2696-17-0x0000000001FE0000-0x0000000002030000-memory.dmp

            Filesize

            320KB

          • memory/2696-21-0x00000000064A0000-0x00000000064E0000-memory.dmp

            Filesize

            256KB

          • memory/2696-25-0x0000000006D20000-0x0000000007560000-memory.dmp

            Filesize

            8.2MB

          • memory/2696-29-0x00000000075F0000-0x0000000007670000-memory.dmp

            Filesize

            512KB

          • memory/2696-33-0x0000000002030000-0x0000000002040000-memory.dmp

            Filesize

            64KB

          • memory/2696-37-0x0000000002660000-0x0000000002670000-memory.dmp

            Filesize

            64KB

          • memory/2696-41-0x0000000007670000-0x0000000007690000-memory.dmp

            Filesize

            128KB

          • memory/2696-45-0x00000000076D0000-0x00000000076F0000-memory.dmp

            Filesize

            128KB

          • memory/2696-49-0x0000000007720000-0x0000000007740000-memory.dmp

            Filesize

            128KB

          • memory/2696-53-0x0000000007790000-0x00000000077D0000-memory.dmp

            Filesize

            256KB

          • memory/2696-57-0x00000000077F0000-0x0000000007810000-memory.dmp

            Filesize

            128KB

          • memory/2696-61-0x0000000007840000-0x0000000007870000-memory.dmp

            Filesize

            192KB

          • memory/2696-81-0x000000013FC90000-0x00000001405C2000-memory.dmp

            Filesize

            9.2MB