f3a123d47a497ba20d726e6c117491b2615fa5db77eb0bedcd62153826e4b0a3

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 01:25

Target

2024-05-04_845d5137db50cd5de9ea5cafa814f5db_ryuk.exe
Size

2.3MB
MD5

845d5137db50cd5de9ea5cafa814f5db
SHA1

b0670c58fc26c6e996600f13ddc642ffc4f24ce7
SHA256

f3a123d47a497ba20d726e6c117491b2615fa5db77eb0bedcd62153826e4b0a3
SHA512

78b7a8c04cc5813eea9e39c2c6cb38dbe2a7b21ef0ba1ccf78a37c2918a0fa3b7eadce9e3538e808e4978fd842228d283856bb661ebf25e929af0433a3776011
SSDEEP

49152:CosQHMmpQAaR824OnqDPqFmhlyjsrrJLp2lUEFP4+Po6kk:44O2P5JLQlVt4ib

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	2024-05-04_845d5137db50cd5de9ea5cafa814f5db_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2736	1756	2024-05-04_845d5137db50cd5de9ea5cafa814f5db_ryuk.exe	29
PID 1756 wrote to memory of 2736	1756	2024-05-04_845d5137db50cd5de9ea5cafa814f5db_ryuk.exe	29
PID 1756 wrote to memory of 2736	1756	2024-05-04_845d5137db50cd5de9ea5cafa814f5db_ryuk.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-05-04_845d5137db50cd5de9ea5cafa814f5db_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-04_845d5137db50cd5de9ea5cafa814f5db_ryuk.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1756 -s 364
  2⤵
  PID:2736

memory/1756-0-0x000000013F3F0000-0x000000013F649000-memory.dmp

Filesize
2.3MB

Download
memory/1756-1-0x000000013F3F0000-0x000000013F649000-memory.dmp

Filesize
2.3MB

Download