bbb9cb6e8e5b9d7e91b4a2c00aafe8d4af371f4857186882c90a2e0fe3606faa

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 01:17

Target
2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe
Size 16.0MB
Sample240607-bnebtsfa6s
SHA256 bbb9cb6e8e5b9d7e91b4a2c00aafe8d4af371f4857186882c90a2e0fe3606faa
MD5 57a958b6559331a9b8cf6a2d1588203f
SHA1 bd6179239bf49f604981f645f54dd969122e6a9a
SHA512 27c7f0913be1e8f229296a0b13aa56785a6fd99f61e9f1cad6676cb2d5dbab34d975aed7432c7ead44d100d64cd1c2bed7b086f8393f8adfe34b1d10de855226
SSDEEP 393216:0lC7hQe5t+SCiCEDElh2p3ZkNRiEFf4ilPRbQEk3:0ov5tlCiCEDKQp3ZkNRi4z
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2624	2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2624	2228	2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe	29
PID 2228 wrote to memory of 2624	2228	2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe	29
PID 2228 wrote to memory of 2624	2228	2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe"
  2⤵
  - Loads dropped DLL
  PID:2624

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI22282\python39.dll
Size 2.8MB
SHA256 09196a7e36fc52574ce45ba94da02ea7d5ee363557cc8ff24ef197b4c303564d
MD5 657df54924a5d77ba515e49b518910f0
SHA1 e2376b87d67ee6d6b028572bb16c5210594c7257
SHA512 1747192757eb68c40cd01451b2af410d803bbacc1f22914a884963931e674eb759b3aaab55e5e7b875e9d4b68e46ba2c7de98fa47b6d4837516edcfa077088c1
SSDEEP 49152:Fj3PQkQ7o11Nr9feH8NoaGh5A9lhIrcoFHuGxOCrls2Xtu6rfPa7w3J1AfkovlBe:RQkQ7o/Qeef6K3AroFVvrH7
MD5 SHA1 SHA512 SSDEEP

Submit Download

python39.dll

Path \Users\Admin\AppData\Local\Temp\_MEI22282\python39.dll
Size 4.3MB
SHA256 a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a
MD5 5cd203d356a77646856341a0c9135fc6
SHA1 a1f4ac5cc2f5ecb075b3d0129e620784814a48f7
SHA512 390008d57fa711d7c88b77937bf16fdb230e7c1e7182faea6d7c206e9f65ced6f2e835f9da9befb941e80624abe45875602e0e7ad485d9a009d2450a2a0e0f1f
SSDEEP 49152:Fj3PQkQ7o11Nr9feH8NoaGh5A9lhIrcoFHuGxOCrls2Xtu6rfPa7w3J1AfkovlBl:RQkQ7o/Qeef6K3AroFVvrHRMRLwbCP
MD5 SHA1 SHA512 SSDEEP

Submit Download