54616d7109aada30e44013b85975d578faeff85c52e2e45b445ba3679f2b5f4c

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 02:31

Target

2024-05-03_b3e8c466c82be628681cdaa67c6245e8_ryuk.exe
Size

2.3MB
MD5

b3e8c466c82be628681cdaa67c6245e8
SHA1

6b2204a4b0ae9b993cff8af39666984e57375c76
SHA256

54616d7109aada30e44013b85975d578faeff85c52e2e45b445ba3679f2b5f4c
SHA512

2c25f9d2e2405ed44ff0928e6d230390eba2ad67e0b75c72785322ad920f3ab7554c0ad10482720753efd31d23ae5dec7ab845eaf1bff4d6f163a9e5095a8ab5
SSDEEP

49152:LosQHMmpQAaR824OnqDPqFmhlyjsrrJLp2lUEFP4+Po6kk:/4O2P5JLQlVt4ib

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	2024-05-03_b3e8c466c82be628681cdaa67c6245e8_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1256	2420	2024-05-03_b3e8c466c82be628681cdaa67c6245e8_ryuk.exe	29
PID 2420 wrote to memory of 1256	2420	2024-05-03_b3e8c466c82be628681cdaa67c6245e8_ryuk.exe	29
PID 2420 wrote to memory of 1256	2420	2024-05-03_b3e8c466c82be628681cdaa67c6245e8_ryuk.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-05-03_b3e8c466c82be628681cdaa67c6245e8_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-03_b3e8c466c82be628681cdaa67c6245e8_ryuk.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2420 -s 364
  2⤵
  PID:1256

memory/2420-0-0x000000013FEA0000-0x00000001400F9000-memory.dmp

Filesize
2.3MB

Download
memory/2420-1-0x000000013FEA0000-0x00000001400F9000-memory.dmp

Filesize
2.3MB

Download