8bae363947aefc7bdb75bfdd6ba2ca49cf875a781bc76c8b2d57901cbca49320

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/04/2024, 01:46

Target

2024-04-24_49f40837020f9f3e5019cb78b0035c6d_ryuk.exe
Size

1.0MB
MD5

49f40837020f9f3e5019cb78b0035c6d
SHA1

5c253896d336c0413cf0a308cf135b487d629bfa
SHA256

8bae363947aefc7bdb75bfdd6ba2ca49cf875a781bc76c8b2d57901cbca49320
SHA512

cae16b096042efd9b6dbc7e53dd83ae9d5b16f1ec7c09d1a4300b515f133c2afd29afd2de1203dcd8ca1c0e3a6dfb347e4b6189026997dca1503578737026101
SSDEEP

24576:ynJbzRAULg/nMl7QED9/9ADC0A8y48LihTJVIVNf07+:ynJbzRnLg/UQa9/S1AX4phTJVIHm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2612	2380	2024-04-24_49f40837020f9f3e5019cb78b0035c6d_ryuk.exe	28
PID 2380 wrote to memory of 2612	2380	2024-04-24_49f40837020f9f3e5019cb78b0035c6d_ryuk.exe	28
PID 2380 wrote to memory of 2612	2380	2024-04-24_49f40837020f9f3e5019cb78b0035c6d_ryuk.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-24_49f40837020f9f3e5019cb78b0035c6d_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-24_49f40837020f9f3e5019cb78b0035c6d_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2380 -s 708
  2⤵
  PID:2612

C:\Users\Admin\AppData\Local\IPlugSpectFFT\settings.ini

Filesize
189B

MD5
77fb254fae75edc9775b6061390caa3a

SHA1
b0bd7bddfa8e86470e5975c937e888810f9b2a3b

SHA256
65fde51ae69a86c0a3b2b2ab6de8bd593386d6b78e27f20d2f11e561e4d11c45

SHA512
d169923de03e0cda28562075804165cf654a042df553eb8c3ecbd520001371537f95dc1373a15a875b6b5c88da8ace5012a6b2d287582d3e5e4a64a7c668b16d

Download Submit