d8c424f2dfab79ac51886b288c940115799ce0594afd55ba68464e0d81d52340

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 10:32

Target

2024-08-06_2d55a671d5218b3c640ec0b28e4627fa_ryuk.exe
Size

346KB
MD5

2d55a671d5218b3c640ec0b28e4627fa
SHA1

e7399bd2939f3523b9e657df5bd0ba97c58959ed
SHA256

d8c424f2dfab79ac51886b288c940115799ce0594afd55ba68464e0d81d52340
SHA512

83589d6c4202c7891f3fb7b38d2699389e6216e4ffcfad11bb3d88e863c14d6e682e22f9953793eb507569da605305a6703541e0890d0a7ef54ebc0d4416c7ec
SSDEEP

6144:U1AtjM+EVs7+W7d2lw4GAcstxxIHohqJpyQyZ:w+M+FdCGAfUo0aQyZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 1760	2152	2024-08-06_2d55a671d5218b3c640ec0b28e4627fa_ryuk.exe	30
PID 2152 wrote to memory of 1760	2152	2024-08-06_2d55a671d5218b3c640ec0b28e4627fa_ryuk.exe	30
PID 2152 wrote to memory of 1760	2152	2024-08-06_2d55a671d5218b3c640ec0b28e4627fa_ryuk.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-08-06_2d55a671d5218b3c640ec0b28e4627fa_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-06_2d55a671d5218b3c640ec0b28e4627fa_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2152 -s 36
  2⤵
  PID:1760