aeff46f42fac83fea690a3f51c69483cbcbe4f5b06f826342cb5ff0492b5b7e5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 00:01

Target

2024-04-30_0feebc04fb9b649850d9294f6babca3c_ryuk.exe
Size

2.3MB
MD5

0feebc04fb9b649850d9294f6babca3c
SHA1

ed326bd0c25dd4e8f47f72d108edb31f8c6c476d
SHA256

aeff46f42fac83fea690a3f51c69483cbcbe4f5b06f826342cb5ff0492b5b7e5
SHA512

f7fee1b0d0293412b04021f88d9617a714df6888c4dd44027649e1c107d57f6aad2433073773e0c155861c5ae2bd0020460cf5e9a74cb8817652754cd8a89551
SSDEEP

49152:SosQHMmpQAaR824OnqDPqFmhlyjsrrJLp2lUEFP4+Po6kk:o4O2P5JLQlVt4ib

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	2024-04-30_0feebc04fb9b649850d9294f6babca3c_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2388	2740	2024-04-30_0feebc04fb9b649850d9294f6babca3c_ryuk.exe	29
PID 2740 wrote to memory of 2388	2740	2024-04-30_0feebc04fb9b649850d9294f6babca3c_ryuk.exe	29
PID 2740 wrote to memory of 2388	2740	2024-04-30_0feebc04fb9b649850d9294f6babca3c_ryuk.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-04-30_0feebc04fb9b649850d9294f6babca3c_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-30_0feebc04fb9b649850d9294f6babca3c_ryuk.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2740 -s 364
  2⤵
  PID:2388

memory/2740-0-0x000000013F730000-0x000000013F989000-memory.dmp

Filesize
2.3MB

Download
memory/2740-1-0x000000013F730000-0x000000013F989000-memory.dmp

Filesize
2.3MB

Download