b7def7c2139cdaa2483a681ed343133f1f034a4d53136d32157c89c8705a4765

Resubmissions

17/03/2025, 03:29

17/03/2025, 03:22

17/03/2025, 01:55

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17/03/2025, 01:55

Target

2025-03-17_ff03d71dba0625380d825791779942dc_ryuk.exe
Size

11.7MB
MD5

ff03d71dba0625380d825791779942dc
SHA1

f7d6e8f6701738718eb250926d73f3070157f913
SHA256

b7def7c2139cdaa2483a681ed343133f1f034a4d53136d32157c89c8705a4765
SHA512

ed32529a3a278af0e49507925806513baf90f6948d98f638cae31489efb30bdc23dfb916d405827aa6dfdc6856ef97bfd89832b17f5d1372759e92ecfd5fcc7d
SSDEEP

196608:a8Hu1FcHZZY0MhCZBTX1QFhjwt25Hnuz48RmU/3ZlsPvXfg2TvN8C1Uggo19T20Q:1HuMHZilAHOHuztN3ZWXBTMw19Sy

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1192	2025-03-17_ff03d71dba0625380d825791779942dc_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1192	2860	2025-03-17_ff03d71dba0625380d825791779942dc_ryuk.exe	30
PID 2860 wrote to memory of 1192	2860	2025-03-17_ff03d71dba0625380d825791779942dc_ryuk.exe	30
PID 2860 wrote to memory of 1192	2860	2025-03-17_ff03d71dba0625380d825791779942dc_ryuk.exe	30

C:\Users\Admin\AppData\Local\Temp\2025-03-17_ff03d71dba0625380d825791779942dc_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-17_ff03d71dba0625380d825791779942dc_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\2025-03-17_ff03d71dba0625380d825791779942dc_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2025-03-17_ff03d71dba0625380d825791779942dc_ryuk.exe"
  2⤵
  - Loads dropped DLL
  PID:1192

C:\Users\Admin\AppData\Local\Temp\_MEI28602\python39.dll

Filesize
4.3MB

MD5
088904a7f5b53107db42e15827e3af98

SHA1
1768e7fb1685410e188f663f5b259710f597e543

SHA256
3761c232e151e9ceaf6c7d37b68da3df1962e3106e425cc3937d1f60170f3718

SHA512
c5edc25fd9a37673f769af1a1fd540b41e68351bc30b44bc83a1d0d4a8fb078888bbb31173a77ef47698631c9816bc05637b499c20d63e3d65457d9aa4bc2c6b

Download Submit