fe3701e7456763ceb63cdff850fc74aa39d928f0d874f434c4fd361a42b91773

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 12:48

Target

2024-06-20_24e98217d599c25111413e871858bca2_ryuk.exe
Size

1.5MB
MD5

24e98217d599c25111413e871858bca2
SHA1

a236592d0a29acae720f05e46318032e399e686e
SHA256

fe3701e7456763ceb63cdff850fc74aa39d928f0d874f434c4fd361a42b91773
SHA512

173bac61053f0e227575b86847d83eba3c1906b0019c33f990226ddaa3c943863d89ee3e3cc5b1255fdb558394f6d7ab29aa2ed907d40f53b2584b819de53ea6
SSDEEP

12288:3gCWsR3KecNO+NTH7JzBLFxmmJJyXAxX330dxgtD4lQ5YdmA1KKHwToNaO5m/3iE:3P1JKecQ+NJF5JJyX2A19HwcNK3iHaT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2236	2232	2024-06-20_24e98217d599c25111413e871858bca2_ryuk.exe	28
PID 2232 wrote to memory of 2236	2232	2024-06-20_24e98217d599c25111413e871858bca2_ryuk.exe	28
PID 2232 wrote to memory of 2236	2232	2024-06-20_24e98217d599c25111413e871858bca2_ryuk.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-20_24e98217d599c25111413e871858bca2_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-20_24e98217d599c25111413e871858bca2_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2232 -s 156
  2⤵
  PID:2236