3ae5e7b42a2ca4a0b48924439b7b2a8d40d401d70a5d9037c4ec3db6c1f1a90a

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 01:49

Target

2024-03-19_4bd3e53875e578810fbd9ecd4b9c8d29_ryuk.exe
Size

9.5MB
MD5

4bd3e53875e578810fbd9ecd4b9c8d29
SHA1

bc41ebace0322faac60d48ab67384dd945dcffb6
SHA256

3ae5e7b42a2ca4a0b48924439b7b2a8d40d401d70a5d9037c4ec3db6c1f1a90a
SHA512

c06a799cd5f674bbd511030324002fd590ea2c1150d6e6a947b2a35c44a372e62172960148cc91d00ef5ab97c80e5ecb212953f84c56f2cd5844d1a9e5a5e748
SSDEEP

196608:Z9+GIxr9onJ5hrZERlyiU8AdZYJERS48RmU/qZlsPvarTaCO8CSIXIqb+A:WPt9c5hlERJAdZYygtNqZWarZIP

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2148	2024-03-19_4bd3e53875e578810fbd9ecd4b9c8d29_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2148	1988	2024-03-19_4bd3e53875e578810fbd9ecd4b9c8d29_ryuk.exe	28
PID 1988 wrote to memory of 2148	1988	2024-03-19_4bd3e53875e578810fbd9ecd4b9c8d29_ryuk.exe	28
PID 1988 wrote to memory of 2148	1988	2024-03-19_4bd3e53875e578810fbd9ecd4b9c8d29_ryuk.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-19_4bd3e53875e578810fbd9ecd4b9c8d29_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-19_4bd3e53875e578810fbd9ecd4b9c8d29_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\2024-03-19_4bd3e53875e578810fbd9ecd4b9c8d29_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-03-19_4bd3e53875e578810fbd9ecd4b9c8d29_ryuk.exe"
  2⤵
  - Loads dropped DLL
  PID:2148

C:\Users\Admin\AppData\Local\Temp\_MEI19882\python39.dll

Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19882\test.exe.manifest

Filesize
1KB

MD5
1d3ba9e96a29d858eced25fdb953c044

SHA1
7b71470dda3f2ee79f4ae57801507aef329d289e

SHA256
130f864bfae66d179a3fcaf65994817c37e4b883319d14d24db1d7d7e19e8d4a

SHA512
253996776bc3337f9a5e40ea72ba710b11605a58115c2db08bcfad7b24127aa2f3d42756324a592702acecdc4fcdfa3771148c143a733b3a404b1802894c1841

Download Submit