a39cb2c31b6724eaa78f60fe29ced83e50ffad7e39efd604a7debdac63a2a80e | Triage

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 02:02

Sharing

Report Analysis Logs

General

Target

2024-11-19_42a5c60fadb3b94505babe3561507a50_ryuk.exe
Size

4.1MB
MD5

42a5c60fadb3b94505babe3561507a50
SHA1

ade46a914ffefa4b1d8b791fbfdf07531c362e44
SHA256

a39cb2c31b6724eaa78f60fe29ced83e50ffad7e39efd604a7debdac63a2a80e
SHA512

d98f41807a0fa8edb5a2f2b054985d753e18deaa06e768045dcab7a108e15ae95dabb0c35506e652dd61d039da43d71d9576638d3ec85ffe46d21e4d18285611
SSDEEP

49152:/xGK0l3e3ubXWCC5JJhZs0wFF2d1vJ2Z:/xGK09yuZZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-11-19_42a5c60fadb3b94505babe3561507a50_ryuk.exe

description	pid	Process	procid_target
PID 880 wrote to memory of 2652	880	2024-11-19_42a5c60fadb3b94505babe3561507a50_ryuk.exe	30
PID 880 wrote to memory of 2652	880	2024-11-19_42a5c60fadb3b94505babe3561507a50_ryuk.exe	30
PID 880 wrote to memory of 2652	880	2024-11-19_42a5c60fadb3b94505babe3561507a50_ryuk.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-11-19_42a5c60fadb3b94505babe3561507a50_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-19_42a5c60fadb3b94505babe3561507a50_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:880
- C:\Users\Admin\AppData\Local\Temp\2024-11-19_42a5c60fadb3b94505babe3561507a50_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-11-19_42a5c60fadb3b94505babe3561507a50_ryuk.exe
  2⤵
  PID:2652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads