f491b62a159a6caa348a2974159a619d22d4966cc3b3a11dcd3d9c80f9d7174d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
07-12-2024 10:57

Target

2024-12-07_ee35b475bb484e21773e0f7db862546b_ryuk.exe
Size

1.6MB
MD5

ee35b475bb484e21773e0f7db862546b
SHA1

c4a28aabfaa76e5079293adad3f618a81244f474
SHA256

f491b62a159a6caa348a2974159a619d22d4966cc3b3a11dcd3d9c80f9d7174d
SHA512

463ff2a575af3ae10fd543e81e179fa18253bf71f0fad33c7b5069e262a44de5dd9d5a5fe69ab1c6f5ca43cdf48d2f079aa7b74f291067bb0e92e4c6d8cb1a60
SSDEEP

24576:bO33WO5nY6FhucxdG043YNPSWkslBUpAHWPYjPNoeEI22WnRYeWy4mdPvAfosBor:GN5YGBxQ04IXXvWAjieO3QTmdQQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2352	2232	2024-12-07_ee35b475bb484e21773e0f7db862546b_ryuk.exe	31
PID 2232 wrote to memory of 2352	2232	2024-12-07_ee35b475bb484e21773e0f7db862546b_ryuk.exe	31
PID 2232 wrote to memory of 2352	2232	2024-12-07_ee35b475bb484e21773e0f7db862546b_ryuk.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-12-07_ee35b475bb484e21773e0f7db862546b_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-07_ee35b475bb484e21773e0f7db862546b_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2232 -s 152
  2⤵
  PID:2352