544120fc34f30c6f20acee1d179009a6523ddab6fe41042611dbd742c8e636bf

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 02:03

Target

2024-11-20_aa3c7b344a5530af4fe0bcb144abd43c_ryuk.exe
Size

4.1MB
MD5

aa3c7b344a5530af4fe0bcb144abd43c
SHA1

511d4295767b735cd2680de4cf08cba827e4b88f
SHA256

544120fc34f30c6f20acee1d179009a6523ddab6fe41042611dbd742c8e636bf
SHA512

247135a19aa034043047f43ac822c5754579baa3f2ec46418e590a23eb84fc527d6f3f58fbae73e995a58b4d3780f078686d60e57c660b823ae6eb211fad10c8
SSDEEP

49152:qxGK0l3e3uoOg15XgLIcT9xacX+pGTt4yy2NtvyNM2R6oZ:qxGK09yuAZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 768	2564	2024-11-20_aa3c7b344a5530af4fe0bcb144abd43c_ryuk.exe	30
PID 2564 wrote to memory of 768	2564	2024-11-20_aa3c7b344a5530af4fe0bcb144abd43c_ryuk.exe	30
PID 2564 wrote to memory of 768	2564	2024-11-20_aa3c7b344a5530af4fe0bcb144abd43c_ryuk.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-11-20_aa3c7b344a5530af4fe0bcb144abd43c_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-20_aa3c7b344a5530af4fe0bcb144abd43c_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Users\Admin\AppData\Local\Temp\2024-11-20_aa3c7b344a5530af4fe0bcb144abd43c_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-11-20_aa3c7b344a5530af4fe0bcb144abd43c_ryuk.exe
  2⤵
  PID:768