cf96ac124b9effbcb9d2b700e34a4f1db2d9695418a8441342670565289fb9dc

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/03/2025, 01:41

Target

2025-03-17_a2bad9554b8b1dd8edcf8667f5dd242b_ryuk.exe
Size

11.9MB
MD5

a2bad9554b8b1dd8edcf8667f5dd242b
SHA1

dd6d72a91166742262f11007b2c9270944ba785e
SHA256

cf96ac124b9effbcb9d2b700e34a4f1db2d9695418a8441342670565289fb9dc
SHA512

7907b8758f4180c3a36d4780c8bfd3eebe40d25c0bff6b0cd293943a0300c3275884a1d611f82a16d20ef66e334f7c4a573861ac55c5535e395b8a102f0eb2a0
SSDEEP

196608:p0XOqTXrTaXPA4pzxw9BK+gpvDq9onJ5hrZER5xQ3jo4U648RmU/3ZlsPvt7+nfk:OTXafVxw9BKpbq9c5hlER5xA26tN3ZWC

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2372	2025-03-17_a2bad9554b8b1dd8edcf8667f5dd242b_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 2372	1036	2025-03-17_a2bad9554b8b1dd8edcf8667f5dd242b_ryuk.exe	30
PID 1036 wrote to memory of 2372	1036	2025-03-17_a2bad9554b8b1dd8edcf8667f5dd242b_ryuk.exe	30
PID 1036 wrote to memory of 2372	1036	2025-03-17_a2bad9554b8b1dd8edcf8667f5dd242b_ryuk.exe	30

C:\Users\Admin\AppData\Local\Temp\2025-03-17_a2bad9554b8b1dd8edcf8667f5dd242b_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-17_a2bad9554b8b1dd8edcf8667f5dd242b_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Admin\AppData\Local\Temp\2025-03-17_a2bad9554b8b1dd8edcf8667f5dd242b_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2025-03-17_a2bad9554b8b1dd8edcf8667f5dd242b_ryuk.exe"
  2⤵
  - Loads dropped DLL
  PID:2372

C:\Users\Admin\AppData\Local\Temp\_MEI10362\payload.exe.manifest

Filesize
1KB

MD5
d67bc153fed4560ceb331087b13dae8c

SHA1
bb61d6806e3c5567a335acf38bd2912fa26825aa

SHA256
0c66d699d5c7490715774dab9b1a9631dfc47233c35ac952ef58fe9e59105a6a

SHA512
dbb67444d9becbdfb6650bea64aa4f2641b66188a690faa4535359faefd25291fd3646a05c87536446af239a8dfdbcc8f453b1b398697bc4dcdb517955e2cb7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10362\python39.dll

Filesize
4.2MB

MD5
c4b75218b11808db4a04255574b2eb33

SHA1
f4a3497fb6972037fb271cfdc5b404a4b28ccf07

SHA256
53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2

SHA512
0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

Download Submit