0f9228939702a12e0c07215383c63734eac714eb32182be2e230eec80c8cfe7d

Resubmissions

09-08-2024 14:23

09-08-2024 13:23

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-08-2024 13:23

Target

2024-08-09_1a5d4cb874f56fe6a97939192d411b8e_wannacry.exe
Size

8.0MB
MD5

1a5d4cb874f56fe6a97939192d411b8e
SHA1

3ef1ef5f95311642729260a8943770d2818bee74
SHA256

0f9228939702a12e0c07215383c63734eac714eb32182be2e230eec80c8cfe7d
SHA512

1ec3765dea6663d7a3b1e4d45066c8453d930f21ffa057a6123ecf7cd037e5bf3f65b46a74e7cc2f399b34b4e4ce74f68e22cc1262977acaffee3c1bdfac8884
SSDEEP

49152:U0qALES64w1sbfMZuZR30hlhbFv6yELWTKZKy/KniB/:5bd3kbFSkOZK9i

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-08-09_1a5d4cb874f56fe6a97939192d411b8e_wannacry.exe

description	pid	process	target process
PID 1940 wrote to memory of 2704	1940	2024-08-09_1a5d4cb874f56fe6a97939192d411b8e_wannacry.exe	WerFault.exe
PID 1940 wrote to memory of 2704	1940	2024-08-09_1a5d4cb874f56fe6a97939192d411b8e_wannacry.exe	WerFault.exe
PID 1940 wrote to memory of 2704	1940	2024-08-09_1a5d4cb874f56fe6a97939192d411b8e_wannacry.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-08-09_1a5d4cb874f56fe6a97939192d411b8e_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-09_1a5d4cb874f56fe6a97939192d411b8e_wannacry.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1940 -s 260
2⤵
PID:2704

memory/1940-0-0x000000013FD70000-0x0000000140608000-memory.dmp

Filesize
8.6MB

Download
memory/1940-1-0x000000013FD70000-0x0000000140608000-memory.dmp

Filesize
8.6MB

Download