a7fa8b651bbb67a6b9f56ac920b4f2bcdeb505c8509d26d9e65b118b3eccb4dc

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 12:58

Target
RedScreenRansomware.exe
Size 14.4MB
Sample240612-p7y28swamd
SHA256 a7fa8b651bbb67a6b9f56ac920b4f2bcdeb505c8509d26d9e65b118b3eccb4dc
MD5 ff5317eb6feb0834422e038ebd7f351c
SHA1 2f2145d81301b1a8a8bc39093b4cc5c95191a241
SHA512 f751c54ce6c12844b4d7d3a82331a076dee55439d2816d915c61b0cbd8286ff2b640905528aba685b387b3dfc704f101769291fab38e15c21ade4be9e9a621fe
SSDEEP 393216:DPDdKcMT61+TtIigeJPPDdyET2Y9Z8D8Ccl107kPX4:DPJTMO1QtIbSPPJyE6a8DZc2kA
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2512	RedScreenRansomware.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2512	2172	RedScreenRansomware.exe	29
PID 2172 wrote to memory of 2512	2172	RedScreenRansomware.exe	29
PID 2172 wrote to memory of 2512	2172	RedScreenRansomware.exe	29

C:\Users\Admin\AppData\Local\Temp\RedScreenRansomware.exe
"C:\Users\Admin\AppData\Local\Temp\RedScreenRansomware.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\RedScreenRansomware.exe
  "C:\Users\Admin\AppData\Local\Temp\RedScreenRansomware.exe"
  2⤵
  - Loads dropped DLL
  PID:2512

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21722\python312.dll
Size 6.6MB
SHA256 c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb
MD5 3c388ce47c0d9117d2a50b3fa5ac981d
SHA1 038484ff7460d03d1d36c23f0de4874cbaea2c48
SHA512 e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35
SSDEEP 49152:77dFcaC296MwQx0AWOO5JqSEShouly4XUV/x3aOvi5lnX79DxW/En8tdFNPhD2SI:7Z+aCnAh8lRA4jvE0ivHHDMiEBaw
MD5 SHA1 SHA512 SSDEEP

Submit Download