3c5a551b8fee65ffc444a3c0730b990591c3a95e442426563539f0a2ca3871d2

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/03/2025, 13:44

Target

2025-03-29_d62b289592043f863f302d7e8582e9bc_black-basta_cobalt-strike_ryuk_satacom.exe
Size

634KB
MD5

d62b289592043f863f302d7e8582e9bc
SHA1

cc72a132de961bb1f4398b933d88585ef8c29a41
SHA256

3c5a551b8fee65ffc444a3c0730b990591c3a95e442426563539f0a2ca3871d2
SHA512

63d389102c1b78ea5157aad0a3f45f351a5752ae896729d85be81b70721f19869efdb8dfa87906f891be9bec0d9154b7498e4ac4216fd3ec574fae64707e258c
SSDEEP

12288:SaQ9+ICJkAp0mBpehM8ppy+E4J/aDQy5b4WeZGl/GtWV3OH2JrZw9RlUR:Kw4GBpehMjcuP5b4Fty3pZwXlUR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2920	1044	2025-03-29_d62b289592043f863f302d7e8582e9bc_black-basta_cobalt-strike_ryuk_satacom.exe	31
PID 1044 wrote to memory of 2920	1044	2025-03-29_d62b289592043f863f302d7e8582e9bc_black-basta_cobalt-strike_ryuk_satacom.exe	31
PID 1044 wrote to memory of 2920	1044	2025-03-29_d62b289592043f863f302d7e8582e9bc_black-basta_cobalt-strike_ryuk_satacom.exe	31

C:\Users\Admin\AppData\Local\Temp\2025-03-29_d62b289592043f863f302d7e8582e9bc_black-basta_cobalt-strike_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-29_d62b289592043f863f302d7e8582e9bc_black-basta_cobalt-strike_ryuk_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1044 -s 44
  2⤵
  PID:2920