e11767bbe1ac5d5e8b58c2147da22cd7d389e4405ba75420e3d7abb069439e0a

Analysis

max time kernel
93s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2024 19:38

Target

2024-10-01_574ce87bddd108284a1cd77ca55de646_cobalt-strike_ryuk.exe
Size

2.6MB
MD5

574ce87bddd108284a1cd77ca55de646
SHA1

545c2b013a1847605415fa95721b4a4d641bbcb2
SHA256

e11767bbe1ac5d5e8b58c2147da22cd7d389e4405ba75420e3d7abb069439e0a
SHA512

6d0939b8b5a3638098e37c653491f3a53339665dba68c634785df7e2352cb88c37673d37a03d42aa1717ece8c4be129521e2bf5f20143e4102e1656442125fe2
SSDEEP

49152:5gHovjgfBkO1FSs2sgEcJw+g0dARJkAEpScTia0wfHys:eRBlb+bpB+UHv

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 4012	3796	2024-10-01_574ce87bddd108284a1cd77ca55de646_cobalt-strike_ryuk.exe	84
PID 3796 wrote to memory of 4012	3796	2024-10-01_574ce87bddd108284a1cd77ca55de646_cobalt-strike_ryuk.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-10-01_574ce87bddd108284a1cd77ca55de646_cobalt-strike_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-01_574ce87bddd108284a1cd77ca55de646_cobalt-strike_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Users\Admin\AppData\Local\Temp\2024-10-01_574ce87bddd108284a1cd77ca55de646_cobalt-strike_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-10-01_574ce87bddd108284a1cd77ca55de646_cobalt-strike_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\HerondLabs\Herond-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Herond --annotation=ver=120.2.0.34 --initial-client-data=0x258,0x25c,0x260,0x234,0x264,0x7ff61eb3f6b0,0x7ff61eb3f6bc,0x7ff61eb3f6c8
  2⤵
  PID:4012