73d9cabb298710377bc5ffaf6b2a2cd401b1c3782682ed0ff6eea417f1415a85

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 09:35

Target

2024-02-21_8f69d8cc368d68a937b320cc730bd8de_ryuk.exe
Size

6.5MB
MD5

8f69d8cc368d68a937b320cc730bd8de
SHA1

4558a5b0f20602f1e9f94cd98b36af6a9f361a88
SHA256

73d9cabb298710377bc5ffaf6b2a2cd401b1c3782682ed0ff6eea417f1415a85
SHA512

058a196fafde09a03666b10abdf42aff6d52afbd85f51a000d63328b6f9d9fda07041b177d461ac0a5f0e456a2679835ceb66ed70facc91e0b90cb3df067851c
SSDEEP

98304:bjmtKS+j6cusl7ZGLAsVuqxSTw0DG7eq8P9GUvk+00RDd3AEoBb/SivPGjnMBOv:bjmtb+2m7gfxSTrqJ8P7MZEx3PAH6Mg

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2256	2024-02-21_8f69d8cc368d68a937b320cc730bd8de_ryuk.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000014ec0-33.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 2256	1476	2024-02-21_8f69d8cc368d68a937b320cc730bd8de_ryuk.exe	28
PID 1476 wrote to memory of 2256	1476	2024-02-21_8f69d8cc368d68a937b320cc730bd8de_ryuk.exe	28
PID 1476 wrote to memory of 2256	1476	2024-02-21_8f69d8cc368d68a937b320cc730bd8de_ryuk.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-21_8f69d8cc368d68a937b320cc730bd8de_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-21_8f69d8cc368d68a937b320cc730bd8de_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\2024-02-21_8f69d8cc368d68a937b320cc730bd8de_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-02-21_8f69d8cc368d68a937b320cc730bd8de_ryuk.exe"
  2⤵
  - Loads dropped DLL
  PID:2256

C:\Users\Admin\AppData\Local\Temp\_MEI14762\python39.dll

Filesize
1.4MB

MD5
2d53929d1eedbea262db184338ee8b71

SHA1
5403d05a2d178db9f050444aeca7f911e511cf6f

SHA256
13d5a2fef5ac539c0ebaa3607363c837ce441ed3002b2462fa356a2969f29b0b

SHA512
2ea51f6068568f7dfe60b23af12ae49d22e638372b2a0c8de50ff22d1f408e17ecd0d80ceb834c39747242adb639bc0d259d84adef764b9badbcc240eeb3d882

Download Submit
memory/2256-35-0x000007FEF6270000-0x000007FEF66F0000-memory.dmp

Filesize
4.5MB

Download