07ed65f9c4620664f5f5aa49a25eeb80f07ccf0041f39010f19ab815f52e2522

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 04:44

Target

2024-05-07_0797f6d86d889cd9c12bd727d99d0b51_ryuk.exe
Size

2.3MB
MD5

0797f6d86d889cd9c12bd727d99d0b51
SHA1

3287c1231711fc3734f5a9fde716486a2796c7ba
SHA256

07ed65f9c4620664f5f5aa49a25eeb80f07ccf0041f39010f19ab815f52e2522
SHA512

d901a35bd737dc37ebb3b0c76ecc488eb467d11eab9ac51a441e057e6980ebe0d0747f8e03227c893c06e4ff84358c0a46d0edfdf2160c95612275e9912d8ba4
SSDEEP

49152:2osQHMmpQAaR824OnqDPqFmhlyjsrrJLp2lUEFP4+Po6kk:k4O2P5JLQlVt4ib

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	880	2024-05-07_0797f6d86d889cd9c12bd727d99d0b51_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 2052	880	2024-05-07_0797f6d86d889cd9c12bd727d99d0b51_ryuk.exe	29
PID 880 wrote to memory of 2052	880	2024-05-07_0797f6d86d889cd9c12bd727d99d0b51_ryuk.exe	29
PID 880 wrote to memory of 2052	880	2024-05-07_0797f6d86d889cd9c12bd727d99d0b51_ryuk.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-05-07_0797f6d86d889cd9c12bd727d99d0b51_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-07_0797f6d86d889cd9c12bd727d99d0b51_ryuk.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 880 -s 364
  2⤵
  PID:2052

memory/880-0-0x000000013F530000-0x000000013F789000-memory.dmp

Filesize
2.3MB

Download
memory/880-1-0x000000013F530000-0x000000013F789000-memory.dmp

Filesize
2.3MB

Download