365c6bf29ff892f1999570a5c37c7aaa82189f25414e3a3aafa9a806c224194e

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
11/11/2024, 16:31

Target

2024-11-11_8c82122d164f7f1529a012963ba3b74b_ryuk.exe
Size

3.6MB
MD5

8c82122d164f7f1529a012963ba3b74b
SHA1

6f6a0115e06857d44b18b5bc8a3677b00400239e
SHA256

365c6bf29ff892f1999570a5c37c7aaa82189f25414e3a3aafa9a806c224194e
SHA512

212305931cdb9b24f73b90469c7f7ba9ba3eb830c6813a718affb5d1bd5e8ee7ed358de66f4bea4e7c2348ef9e82a8ec4fa9f5bd8e1f93fecfeb3b86d8f27f3d
SSDEEP

24576:wiSVYduVRYxf0fXR/Shty9K3kBqLiP7qe6prKlP4NmMdMhcfYpiSARuMxRHFW79k:0QusxfsohthU4UzLesswFxnE1p

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 2516	596	2024-11-11_8c82122d164f7f1529a012963ba3b74b_ryuk.exe	30
PID 596 wrote to memory of 2516	596	2024-11-11_8c82122d164f7f1529a012963ba3b74b_ryuk.exe	30
PID 596 wrote to memory of 2516	596	2024-11-11_8c82122d164f7f1529a012963ba3b74b_ryuk.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-11-11_8c82122d164f7f1529a012963ba3b74b_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-11_8c82122d164f7f1529a012963ba3b74b_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:596
- C:\Users\Admin\AppData\Local\Temp\2024-11-11_8c82122d164f7f1529a012963ba3b74b_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-11-11_8c82122d164f7f1529a012963ba3b74b_ryuk.exe
  2⤵
  PID:2516