bbb9cb6e8e5b9d7e91b4a2c00aafe8d4af371f4857186882c90a2e0fe3606faa

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-06-2024 01:17

Target

2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe
Size

16.0MB
MD5

57a958b6559331a9b8cf6a2d1588203f
SHA1

bd6179239bf49f604981f645f54dd969122e6a9a
SHA256

bbb9cb6e8e5b9d7e91b4a2c00aafe8d4af371f4857186882c90a2e0fe3606faa
SHA512

27c7f0913be1e8f229296a0b13aa56785a6fd99f61e9f1cad6676cb2d5dbab34d975aed7432c7ead44d100d64cd1c2bed7b086f8393f8adfe34b1d10de855226
SSDEEP

393216:0lC7hQe5t+SCiCEDElh2p3ZkNRiEFf4ilPRbQEk3:0ov5tlCiCEDKQp3ZkNRi4z

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2624	2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2624	2228	2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe	29
PID 2228 wrote to memory of 2624	2228	2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe	29
PID 2228 wrote to memory of 2624	2228	2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-06-07_57a958b6559331a9b8cf6a2d1588203f_ryuk.exe"
  2⤵
  - Loads dropped DLL
  PID:2624

C:\Users\Admin\AppData\Local\Temp\_MEI22282\python39.dll

Filesize
2.8MB

MD5
657df54924a5d77ba515e49b518910f0

SHA1
e2376b87d67ee6d6b028572bb16c5210594c7257

SHA256
09196a7e36fc52574ce45ba94da02ea7d5ee363557cc8ff24ef197b4c303564d

SHA512
1747192757eb68c40cd01451b2af410d803bbacc1f22914a884963931e674eb759b3aaab55e5e7b875e9d4b68e46ba2c7de98fa47b6d4837516edcfa077088c1

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI22282\python39.dll

Filesize
4.3MB

MD5
5cd203d356a77646856341a0c9135fc6

SHA1
a1f4ac5cc2f5ecb075b3d0129e620784814a48f7

SHA256
a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a

SHA512
390008d57fa711d7c88b77937bf16fdb230e7c1e7182faea6d7c206e9f65ced6f2e835f9da9befb941e80624abe45875602e0e7ad485d9a009d2450a2a0e0f1f

Download Submit