bbd895f58d140f56d3117dc6ffad30ca35e3c2a3ca7cd3e4c9a0b62324bfff80

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-06-2024 00:50

Target

2024-06-07_0cfb70b3fc4c4952ce3b0937baa8242a_ryuk.exe
Size

17.0MB
MD5

0cfb70b3fc4c4952ce3b0937baa8242a
SHA1

00d6cf381b85b63fe42534a0a4b8a3768cdb9a5e
SHA256

bbd895f58d140f56d3117dc6ffad30ca35e3c2a3ca7cd3e4c9a0b62324bfff80
SHA512

9869ad4f4f8b60126e4c4533f352ba8537c1353a0e14d83efb72df28341a85c4672a143424f3edc57ee5ba8ef8facbe9c0ac840b88ca4be23cd1ba39b42c5b58
SSDEEP

393216:SMaHK8Pj9c5hlER35ShR4uw3AdZYyKLI0RtN3ZWarz4ENd8Oxr4Z+DS:EqgJEhkpQ27AdZKc+tN3DpNJ3

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2184	2024-06-07_0cfb70b3fc4c4952ce3b0937baa8242a_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2184	2180	2024-06-07_0cfb70b3fc4c4952ce3b0937baa8242a_ryuk.exe	28
PID 2180 wrote to memory of 2184	2180	2024-06-07_0cfb70b3fc4c4952ce3b0937baa8242a_ryuk.exe	28
PID 2180 wrote to memory of 2184	2180	2024-06-07_0cfb70b3fc4c4952ce3b0937baa8242a_ryuk.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-07_0cfb70b3fc4c4952ce3b0937baa8242a_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-07_0cfb70b3fc4c4952ce3b0937baa8242a_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\2024-06-07_0cfb70b3fc4c4952ce3b0937baa8242a_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-06-07_0cfb70b3fc4c4952ce3b0937baa8242a_ryuk.exe"
  2⤵
  - Loads dropped DLL
  PID:2184

C:\Users\Admin\AppData\Local\Temp\_MEI21802\python39.dll

Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit