b0dc66637ad1043b6304d6147bff20b5743e803e1a0b8a3839ddd7199f0b7d07

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 08:00

Target
2024-06-07_6efc7e936fa8c77ac03a918e74eef93d_ryuk.exe
Size 11.0MB
Sample240607-jwexbsch7x
SHA256 b0dc66637ad1043b6304d6147bff20b5743e803e1a0b8a3839ddd7199f0b7d07
MD5 6efc7e936fa8c77ac03a918e74eef93d
SHA1 d2ece63dbd800c8737a3293230bf4c9fef4330a0
SHA512 1965f19d6d67610ac51cfb8bcd16bce7cadb2d66148eb49c54f1277cca26d698968bcf83edae1f5356c2be732da40d5daaaea0ccca87580fd6da661ed39fb665
SSDEEP 196608:EBc7+jX+7+GI+r9onJ5hrZERlyiU8AdZYJERXEzsDO48RmU/qZlsPvarTwRN8Cph:qcOPA9c5hlERJAdZYy90RtNqZWarMVnx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1240	2024-06-07_6efc7e936fa8c77ac03a918e74eef93d_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1240	2188	2024-06-07_6efc7e936fa8c77ac03a918e74eef93d_ryuk.exe	28
PID 2188 wrote to memory of 1240	2188	2024-06-07_6efc7e936fa8c77ac03a918e74eef93d_ryuk.exe	28
PID 2188 wrote to memory of 1240	2188	2024-06-07_6efc7e936fa8c77ac03a918e74eef93d_ryuk.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-07_6efc7e936fa8c77ac03a918e74eef93d_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-07_6efc7e936fa8c77ac03a918e74eef93d_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Users\Admin\AppData\Local\Temp\2024-06-07_6efc7e936fa8c77ac03a918e74eef93d_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-06-07_6efc7e936fa8c77ac03a918e74eef93d_ryuk.exe"
  2⤵
  - Loads dropped DLL
  PID:1240

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21882\python39.dll
Size 4.3MB
SHA256 0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c
MD5 11c051f93c922d6b6b4829772f27a5be
SHA1 42fbdf3403a4bc3d46d348ca37a9f835e073d440
SHA512 1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6
SSDEEP 49152:1kYH+B/E8d7YHDCxJvUIIHd4hP8wuqNdOMFit/gxSwzaBuv4lz1ZRVgwWFJfzMpg:zo7Yq0a2YaCIIzcHxJ7HtMU5weHWeMt
MD5 SHA1 SHA512 SSDEEP

Submit Download