01ef003a7cb1fffabe59634428945af48072e966eaae2b8b104cf21ce1ecc096

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 18:51

Target

2024-04-29_644ee5f687a947aebfe6f16ef8c93c54_ryuk.exe
Size

2.3MB
MD5

644ee5f687a947aebfe6f16ef8c93c54
SHA1

d373fb9f59c19ae309a11875280c11a12ae5ad16
SHA256

01ef003a7cb1fffabe59634428945af48072e966eaae2b8b104cf21ce1ecc096
SHA512

ca9ad894c2a5586007e4793a88e484996489d45f7b4dbfa51f5012541dc139c0fd49b752bf9d5e7d7b1dafb7b24e423bc2843a2d6624e5c04ad7b6b36c9443e7
SSDEEP

49152:PosQHMmpQAaR824OnqDPqFmhlyjsrrJLp2lUEFP4+Po6kk:r4O2P5JLQlVt4ib

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	2024-04-29_644ee5f687a947aebfe6f16ef8c93c54_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2132	2960	2024-04-29_644ee5f687a947aebfe6f16ef8c93c54_ryuk.exe	29
PID 2960 wrote to memory of 2132	2960	2024-04-29_644ee5f687a947aebfe6f16ef8c93c54_ryuk.exe	29
PID 2960 wrote to memory of 2132	2960	2024-04-29_644ee5f687a947aebfe6f16ef8c93c54_ryuk.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-04-29_644ee5f687a947aebfe6f16ef8c93c54_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-29_644ee5f687a947aebfe6f16ef8c93c54_ryuk.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2960 -s 364
  2⤵
  PID:2132

memory/2960-0-0x000000013F950000-0x000000013FBA9000-memory.dmp

Filesize
2.3MB

Download
memory/2960-1-0x000000013F950000-0x000000013FBA9000-memory.dmp

Filesize
2.3MB

Download