7bc6a3c8590a8936ea9618d7bd0c09f9ab1ca7524e52ce6c482c4a55b1d5234c

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 01:23

Target

2024-05-04_761acac3821dd8977257407410b3aa10_ryuk.exe
Size

2.3MB
MD5

761acac3821dd8977257407410b3aa10
SHA1

04811c23a0bb1614bd3dc260129a9cb86a9dca2e
SHA256

7bc6a3c8590a8936ea9618d7bd0c09f9ab1ca7524e52ce6c482c4a55b1d5234c
SHA512

8f3f7dc03215a09d9cf40c7cd6e907f00c7a542ef0ce56c8817b43c3fd1265cdb89ca73fa15b38e0755c7a06f07bbeafaf1510acbac446c3bb3ae36cffc1bca9
SSDEEP

49152:GosQHMmpQAaR824OnqDPqFmhlyjsrrJLp2lUEFP4+Po6kk:U4O2P5JLQlVt4ib

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2344	2024-05-04_761acac3821dd8977257407410b3aa10_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 1160	2344	2024-05-04_761acac3821dd8977257407410b3aa10_ryuk.exe	29
PID 2344 wrote to memory of 1160	2344	2024-05-04_761acac3821dd8977257407410b3aa10_ryuk.exe	29
PID 2344 wrote to memory of 1160	2344	2024-05-04_761acac3821dd8977257407410b3aa10_ryuk.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-05-04_761acac3821dd8977257407410b3aa10_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-04_761acac3821dd8977257407410b3aa10_ryuk.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2344 -s 364
  2⤵
  PID:1160

memory/2344-0-0x000000013FAF0000-0x000000013FD49000-memory.dmp

Filesize
2.3MB

Download
memory/2344-1-0x000000013FAF0000-0x000000013FD49000-memory.dmp

Filesize
2.3MB

Download