ca85e514d3c70a5fe9838682ae64a4392c1589cbfc5591828dd8d7cd102194ad

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 08:37

Target

ryujinx-1.1.1403-win_x64.7z
Size

44.5MB
MD5

70fdeb7e91997c27e13325ce4abf2e35
SHA1

7a7c6d134efdc8218dcd4618e9c3f37739376f93
SHA256

ca85e514d3c70a5fe9838682ae64a4392c1589cbfc5591828dd8d7cd102194ad
SHA512

2588f9370fb1f7d4592d89d55ac1a0563dba2a5bf383aa7dc79e5dbba2414da25b212640f977ceaf1bd7889bdeed37daed093f965a3f92769459cc908c2877ab
SSDEEP

786432:lGKqM56Fn+DEsjWEH1tV0c24L1k0c9JB3E7XqdAWQxoj5LtUjBOPP467QZI6:lFEcYEH1tV0c9O0c9JabWnQxojLUjBk4

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2764	2908	cmd.exe	31
PID 2908 wrote to memory of 2764	2908	cmd.exe	31
PID 2908 wrote to memory of 2764	2908	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ryujinx-1.1.1403-win_x64.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ryujinx-1.1.1403-win_x64.7z
  2⤵
  - Modifies registry class
  PID:2764

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact