f300b47048ba1a8299ead5b432c3293ec3c36ae037c65f05f76f0ac3b0752805

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 18:42

Target

2024-04-15_5d999e9d712f8624d84181616590a257_ryuk.exe
Size

1.3MB
MD5

5d999e9d712f8624d84181616590a257
SHA1

126abb7547dfa2d5a8c008723ed183d1e5ae75ed
SHA256

f300b47048ba1a8299ead5b432c3293ec3c36ae037c65f05f76f0ac3b0752805
SHA512

8e4b897008a41f6507b4cc8372489c65c3ce401983a1b1569151fcc95e4e25a624f8e9054220a67ea6f8cdb76b3c4f3aa6efc60f19f516d65b7932ffa118a687
SSDEEP

12288:BdK+CPYka7G1jhTu1ujGLsWeink64kcXzO3bwt8Wwx5zdSIInRoz3Uv:Jpx0cuKIWeinDgzO3UtQUIIRq8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2176	3068	2024-04-15_5d999e9d712f8624d84181616590a257_ryuk.exe	28
PID 3068 wrote to memory of 2176	3068	2024-04-15_5d999e9d712f8624d84181616590a257_ryuk.exe	28
PID 3068 wrote to memory of 2176	3068	2024-04-15_5d999e9d712f8624d84181616590a257_ryuk.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-15_5d999e9d712f8624d84181616590a257_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-15_5d999e9d712f8624d84181616590a257_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3068 -s 152
  2⤵
  PID:2176