70de5515807069d10356f3a2774b1478a709176c5694672a2aafe6df87cd4fd3

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 10:27

Target

2024-11-20_160b64017e4192dd2b83d7d5bb48319d_ryuk.exe
Size

4.1MB
MD5

160b64017e4192dd2b83d7d5bb48319d
SHA1

9e749fb40f04294f43350cb98f39bb71dc960aad
SHA256

70de5515807069d10356f3a2774b1478a709176c5694672a2aafe6df87cd4fd3
SHA512

d18ad4b5051c6c8932713f94be42fa3e88a5ee925a605335ba860df02db3579d72bceae8b57278983d5dd990b2d7c33ce735fe67a7424ef124f693722fe597ab
SSDEEP

49152:/xGK0l3e3uj1l1N/AqMwuPK0fR1en/K/Q6Z:/xGK09yuEZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2104	3044	2024-11-20_160b64017e4192dd2b83d7d5bb48319d_ryuk.exe	30
PID 3044 wrote to memory of 2104	3044	2024-11-20_160b64017e4192dd2b83d7d5bb48319d_ryuk.exe	30
PID 3044 wrote to memory of 2104	3044	2024-11-20_160b64017e4192dd2b83d7d5bb48319d_ryuk.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-11-20_160b64017e4192dd2b83d7d5bb48319d_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-20_160b64017e4192dd2b83d7d5bb48319d_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\2024-11-20_160b64017e4192dd2b83d7d5bb48319d_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-11-20_160b64017e4192dd2b83d7d5bb48319d_ryuk.exe
  2⤵
  PID:2104