cbb5d6740bb58f3b8fe93408fd2fbc968023c121de1089c885a824c5a67e16e6

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/03/2025, 15:54

Target

2025-03-30_ef37cc9579f995f2f594bf5afa9abbc4_black-basta_cobalt-strike_ryuk_satacom.exe
Size

710KB
MD5

ef37cc9579f995f2f594bf5afa9abbc4
SHA1

e45d95b95fdcc2cc4cd39a0143dc8768e48182a7
SHA256

cbb5d6740bb58f3b8fe93408fd2fbc968023c121de1089c885a824c5a67e16e6
SHA512

4939c796abc2ee80dd316a0c8f51dba3566b981222dd98624e2c7015bb8e1aa61a67f69dccacf36999b6fc44dda86d2967b338c8016869223ab00c59961cf83d
SSDEEP

12288:KIR5x+u6RfbWYCrt/22puGGh6abmMbvZwPO5ICBwu1L8idw0sDn2GVr8DY+31PmE:I3WYatucdvGwu1I4EN+zF+Mt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2244	2188	2025-03-30_ef37cc9579f995f2f594bf5afa9abbc4_black-basta_cobalt-strike_ryuk_satacom.exe	30
PID 2188 wrote to memory of 2244	2188	2025-03-30_ef37cc9579f995f2f594bf5afa9abbc4_black-basta_cobalt-strike_ryuk_satacom.exe	30
PID 2188 wrote to memory of 2244	2188	2025-03-30_ef37cc9579f995f2f594bf5afa9abbc4_black-basta_cobalt-strike_ryuk_satacom.exe	30

C:\Users\Admin\AppData\Local\Temp\2025-03-30_ef37cc9579f995f2f594bf5afa9abbc4_black-basta_cobalt-strike_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-30_ef37cc9579f995f2f594bf5afa9abbc4_black-basta_cobalt-strike_ryuk_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2188 -s 28
  2⤵
  PID:2244