15149b0fa15fe27b6cafc0088080b67ad2125eeafb29d0fe0dc9f819d694c1c3

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 20:48

Target

2024-04-25_22527af9403af6d2cae89d7f066057bb_ryuk.exe
Size

115KB
MD5

22527af9403af6d2cae89d7f066057bb
SHA1

45db7cbc3a31dda3aa5dc4f9e3b2f57d27c64459
SHA256

15149b0fa15fe27b6cafc0088080b67ad2125eeafb29d0fe0dc9f819d694c1c3
SHA512

71a080cc9821482d09898776d1f515763434306dbe67a04d1db5e4209e49af1778a16be123fbf2986dc1a22ce2de897dd71903f287b55cd73891dd6c637596f6
SSDEEP

3072:LGbabld/rR5m334fRXvpunxklQHQAxcVJ0fs:LGba7/rHVfJvpluw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-04-25_22527af9403af6d2cae89d7f066057bb_ryuk.exe

description	pid	process	target process
PID 1228 wrote to memory of 1716	1228	2024-04-25_22527af9403af6d2cae89d7f066057bb_ryuk.exe	WerFault.exe
PID 1228 wrote to memory of 1716	1228	2024-04-25_22527af9403af6d2cae89d7f066057bb_ryuk.exe	WerFault.exe
PID 1228 wrote to memory of 1716	1228	2024-04-25_22527af9403af6d2cae89d7f066057bb_ryuk.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-25_22527af9403af6d2cae89d7f066057bb_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-25_22527af9403af6d2cae89d7f066057bb_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1228 -s 32
2⤵
PID:1716