ccb4979c33f4202a5b3db52f606a9850130f9f4467f58662220edfa1f06c5b80

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 00:51

Target

2024-08-02_2212d64ca76bf1321ffe67f51cf1ff3c_cobalt-strike_ryuk.exe
Size

1.2MB
MD5

2212d64ca76bf1321ffe67f51cf1ff3c
SHA1

ba9ba9ae4b1187bd65153982efddf5557aff2ad8
SHA256

ccb4979c33f4202a5b3db52f606a9850130f9f4467f58662220edfa1f06c5b80
SHA512

005b606d8950b250345532c88ecde20db957f0a3c817899dc56c5a8c77b1f5109be0dc7841799a6377186b01c9185a2af76f4b0dbe81ead3c4c45bb931cbdecd
SSDEEP

12288:cJeVB39XDW5/yuneMCajPhIASXDXs31ft0H4Wb8H0NWCY3gZumOpS8R/bFojwbbG:csTNDRM9Ph30s31ft6i0Nt2bWw+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2944	2884	2024-08-02_2212d64ca76bf1321ffe67f51cf1ff3c_cobalt-strike_ryuk.exe	30
PID 2884 wrote to memory of 2944	2884	2024-08-02_2212d64ca76bf1321ffe67f51cf1ff3c_cobalt-strike_ryuk.exe	30
PID 2884 wrote to memory of 2944	2884	2024-08-02_2212d64ca76bf1321ffe67f51cf1ff3c_cobalt-strike_ryuk.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-08-02_2212d64ca76bf1321ffe67f51cf1ff3c_cobalt-strike_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-02_2212d64ca76bf1321ffe67f51cf1ff3c_cobalt-strike_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2884 -s 152
  2⤵
  PID:2944