bcb964a6282aae833177b35bb3327fcef151f4b68df41e42f199034a8c0ab021

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 10:36

Target

2024-09-30_ff81cc3f102735a64e27b546bbfd7600_ryuk.exe
Size

7.1MB
MD5

ff81cc3f102735a64e27b546bbfd7600
SHA1

2db12e278841814864f9322996c3f4a6e95daf8f
SHA256

bcb964a6282aae833177b35bb3327fcef151f4b68df41e42f199034a8c0ab021
SHA512

443a24735dd1d5bcdfb6afdfe1768ab9df6a5bb03af35dc0b275940b25788fd9f07ea50148ace68d908571eacf8e04d06e59e273130aa10cdc18c6e029b42514
SSDEEP

196608:lY+gp1DM9onJ5hrZER9xQ3jo4UR7+zKUlQ30hUC:GpNM9c5hlER9xA2RSWGQ3

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2544	2024-09-30_ff81cc3f102735a64e27b546bbfd7600_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2544	2516	2024-09-30_ff81cc3f102735a64e27b546bbfd7600_ryuk.exe	31
PID 2516 wrote to memory of 2544	2516	2024-09-30_ff81cc3f102735a64e27b546bbfd7600_ryuk.exe	31
PID 2516 wrote to memory of 2544	2516	2024-09-30_ff81cc3f102735a64e27b546bbfd7600_ryuk.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-09-30_ff81cc3f102735a64e27b546bbfd7600_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-30_ff81cc3f102735a64e27b546bbfd7600_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\2024-09-30_ff81cc3f102735a64e27b546bbfd7600_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-09-30_ff81cc3f102735a64e27b546bbfd7600_ryuk.exe"
  2⤵
  - Loads dropped DLL
  PID:2544

C:\Users\Admin\AppData\Local\Temp\_MEI25162\python39.dll

Filesize
4.2MB

MD5
c4b75218b11808db4a04255574b2eb33

SHA1
f4a3497fb6972037fb271cfdc5b404a4b28ccf07

SHA256
53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2

SHA512
0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

Download Submit