a2c102c31e5d952419c7f16428deda0a0165ef50954878d51e294eb575963165

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-12-2024 01:44

Target

2024-12-07_559a5c313cc49946be78eb255ec5d1f9_ryuk.exe
Size

4.1MB
MD5

559a5c313cc49946be78eb255ec5d1f9
SHA1

08d73de6c7c84aa2b617f060dacc79d93febff40
SHA256

a2c102c31e5d952419c7f16428deda0a0165ef50954878d51e294eb575963165
SHA512

dd99ed19af420a9ca77a63e40b9c25908d3105ada4eb95ca4d410e5ce77d70d2d99fbfba03d0f819cd5024ddbf2296d4a23bbdd11a3e37c3ac613b5f2bfa98d7
SSDEEP

49152:Xl4UjB0jUu3PoPX+uNf39mJU7lBbj1YydVcMNVrvatv2BrNHxg5QqoZ1A:14UjKgucA

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2316 set thread context of 2936	2316	2024-12-07_559a5c313cc49946be78eb255ec5d1f9_ryuk.exe	31

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2936	2316	2024-12-07_559a5c313cc49946be78eb255ec5d1f9_ryuk.exe	31
PID 2316 wrote to memory of 2936	2316	2024-12-07_559a5c313cc49946be78eb255ec5d1f9_ryuk.exe	31
PID 2316 wrote to memory of 2936	2316	2024-12-07_559a5c313cc49946be78eb255ec5d1f9_ryuk.exe	31
PID 2316 wrote to memory of 2936	2316	2024-12-07_559a5c313cc49946be78eb255ec5d1f9_ryuk.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-12-07_559a5c313cc49946be78eb255ec5d1f9_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-07_559a5c313cc49946be78eb255ec5d1f9_ryuk.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\2024-12-07_559a5c313cc49946be78eb255ec5d1f9_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-12-07_559a5c313cc49946be78eb255ec5d1f9_ryuk.exe"
  2⤵
  PID:2936

memory/2936-2-0x000007FFFFFDA000-0x000007FFFFFDB000-memory.dmp

Filesize
4KB

Download