cd6895d9d9102ea27dac2c4208dacb42efe9a21960e5794880c211726ecf3e6e

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 06:54

Target
2024-06-07_56a61ec905a38e792f1f9a8dda82a481_ryuk.exe
Size 30.4MB
Sample240607-hpnefsda87
SHA256 cd6895d9d9102ea27dac2c4208dacb42efe9a21960e5794880c211726ecf3e6e
MD5 56a61ec905a38e792f1f9a8dda82a481
SHA1 da90c55e522b6be898c50c803ff6c28ccf93f456
SHA512 df593826009da836bcefa9353275d6ff5d728984ccf759f9c92e423778b8aec20adf2adca2e6c1e9f872c0f33978b5060554b1f24128cf9052ed3be4aacf1103
SSDEEP 786432:BYUbmEhkUXAF9nysQpr+kYAdZk+tN3DImWX:GUyE1XK9ntDkykE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2512	2024-06-07_56a61ec905a38e792f1f9a8dda82a481_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2512	2460	2024-06-07_56a61ec905a38e792f1f9a8dda82a481_ryuk.exe	28
PID 2460 wrote to memory of 2512	2460	2024-06-07_56a61ec905a38e792f1f9a8dda82a481_ryuk.exe	28
PID 2460 wrote to memory of 2512	2460	2024-06-07_56a61ec905a38e792f1f9a8dda82a481_ryuk.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-07_56a61ec905a38e792f1f9a8dda82a481_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-07_56a61ec905a38e792f1f9a8dda82a481_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Users\Admin\AppData\Local\Temp\2024-06-07_56a61ec905a38e792f1f9a8dda82a481_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-06-07_56a61ec905a38e792f1f9a8dda82a481_ryuk.exe"
  2⤵
  - Loads dropped DLL
  PID:2512

main.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\_MEI24602\main.exe.manifest
Size 1KB
SHA256 0ab101231858435ecbcc9274a3db01d3a41176452b828c6290bb9241aa50deb3
MD5 ede31d67bc78e42bfc1e1c56d0a930f6
SHA1 af93601c2b7ae3442142186dc98b677701567c97
SHA512 e1f24c97f8c3d88abd0442844bdb655277b7f254fd29ff324b80d1b5357de39e830a28b3bd1367d5f75911bf6fe11e597ba6d88cf0860c0e56fbf96669b49d02
MD5 SHA1 SHA512

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24602\python39.dll
Size 4.3MB
SHA256 0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c
MD5 11c051f93c922d6b6b4829772f27a5be
SHA1 42fbdf3403a4bc3d46d348ca37a9f835e073d440
SHA512 1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6
SSDEEP 49152:1kYH+B/E8d7YHDCxJvUIIHd4hP8wuqNdOMFit/gxSwzaBuv4lz1ZRVgwWFJfzMpg:zo7Yq0a2YaCIIzcHxJ7HtMU5weHWeMt
MD5 SHA1 SHA512 SSDEEP

Submit Download