cd6895d9d9102ea27dac2c4208dacb42efe9a21960e5794880c211726ecf3e6e

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 06:54

Target

2024-06-07_56a61ec905a38e792f1f9a8dda82a481_ryuk.exe
Size

30.4MB
MD5

56a61ec905a38e792f1f9a8dda82a481
SHA1

da90c55e522b6be898c50c803ff6c28ccf93f456
SHA256

cd6895d9d9102ea27dac2c4208dacb42efe9a21960e5794880c211726ecf3e6e
SHA512

df593826009da836bcefa9353275d6ff5d728984ccf759f9c92e423778b8aec20adf2adca2e6c1e9f872c0f33978b5060554b1f24128cf9052ed3be4aacf1103
SSDEEP

786432:BYUbmEhkUXAF9nysQpr+kYAdZk+tN3DImWX:GUyE1XK9ntDkykE

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2512	2024-06-07_56a61ec905a38e792f1f9a8dda82a481_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2512	2460	2024-06-07_56a61ec905a38e792f1f9a8dda82a481_ryuk.exe	28
PID 2460 wrote to memory of 2512	2460	2024-06-07_56a61ec905a38e792f1f9a8dda82a481_ryuk.exe	28
PID 2460 wrote to memory of 2512	2460	2024-06-07_56a61ec905a38e792f1f9a8dda82a481_ryuk.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-07_56a61ec905a38e792f1f9a8dda82a481_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-07_56a61ec905a38e792f1f9a8dda82a481_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Users\Admin\AppData\Local\Temp\2024-06-07_56a61ec905a38e792f1f9a8dda82a481_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-06-07_56a61ec905a38e792f1f9a8dda82a481_ryuk.exe"
  2⤵
  - Loads dropped DLL
  PID:2512

C:\Users\Admin\AppData\Local\Temp\_MEI24602\main.exe.manifest

Filesize
1KB

MD5
ede31d67bc78e42bfc1e1c56d0a930f6

SHA1
af93601c2b7ae3442142186dc98b677701567c97

SHA256
0ab101231858435ecbcc9274a3db01d3a41176452b828c6290bb9241aa50deb3

SHA512
e1f24c97f8c3d88abd0442844bdb655277b7f254fd29ff324b80d1b5357de39e830a28b3bd1367d5f75911bf6fe11e597ba6d88cf0860c0e56fbf96669b49d02

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24602\python39.dll

Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit