533bb11f9a65dbaf506536b93ff9a3040d11f7c43b025a2264694871fd780c18

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 00:57

Target

2024-05-20_f3825b4d9196c0bd4bd664f74d9b60d0_ryuk.exe
Size

1.6MB
MD5

f3825b4d9196c0bd4bd664f74d9b60d0
SHA1

004ddbb609cac5bc4150a72dc6d70729ae71ef8c
SHA256

533bb11f9a65dbaf506536b93ff9a3040d11f7c43b025a2264694871fd780c18
SHA512

bd6f56e094b5a5096e1813ca8236578d9518c38ddadf437f7800a4efc4b359d69fd07b6a07dc58be2d7b9dd6b2e75b64788dd23c3abff2b99377dbc73bad178a
SSDEEP

49152:6a8zFDlNQ8feImZXqweq2pNRj6KIeVSc/zui+:oFDlN3mZ6w/2p76K2c/ii+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-20_f3825b4d9196c0bd4bd664f74d9b60d0_ryuk.exe

description	pid	process	target process
PID 2380 wrote to memory of 1804	2380	2024-05-20_f3825b4d9196c0bd4bd664f74d9b60d0_ryuk.exe	WerFault.exe
PID 2380 wrote to memory of 1804	2380	2024-05-20_f3825b4d9196c0bd4bd664f74d9b60d0_ryuk.exe	WerFault.exe
PID 2380 wrote to memory of 1804	2380	2024-05-20_f3825b4d9196c0bd4bd664f74d9b60d0_ryuk.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-20_f3825b4d9196c0bd4bd664f74d9b60d0_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-20_f3825b4d9196c0bd4bd664f74d9b60d0_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2380 -s 152
  2⤵
  PID:1804