49c8db48c43861be5087f96e5f934f8f6e3a3931e75613fd87127fa29edd62f1

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/03/2025, 02:14

Target

2025-03-31_ba7cfbfe4ee11ed0bb81a7b71de91922_black-basta_cobalt-strike_ryuk_satacom.exe
Size

1.9MB
MD5

ba7cfbfe4ee11ed0bb81a7b71de91922
SHA1

08f3a7cd51e1ea055ff7fbdcbd93c08b689773bc
SHA256

49c8db48c43861be5087f96e5f934f8f6e3a3931e75613fd87127fa29edd62f1
SHA512

3121d0f1e389d9f9b5faeebfa35e1a218f1a5c594beac41106c5cb85c5f6f7a6ffbab58035517833c36d6a42550156e19d0d832c80742264b4cdfb68d61175b6
SSDEEP

24576:NNI2LXlFLf2uee/0kd+mELBX11GyDXcOSbNpZw1lUR:LnFFytug1lUR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 2692	988	2025-03-31_ba7cfbfe4ee11ed0bb81a7b71de91922_black-basta_cobalt-strike_ryuk_satacom.exe	31
PID 988 wrote to memory of 2692	988	2025-03-31_ba7cfbfe4ee11ed0bb81a7b71de91922_black-basta_cobalt-strike_ryuk_satacom.exe	31
PID 988 wrote to memory of 2692	988	2025-03-31_ba7cfbfe4ee11ed0bb81a7b71de91922_black-basta_cobalt-strike_ryuk_satacom.exe	31

C:\Users\Admin\AppData\Local\Temp\2025-03-31_ba7cfbfe4ee11ed0bb81a7b71de91922_black-basta_cobalt-strike_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-31_ba7cfbfe4ee11ed0bb81a7b71de91922_black-basta_cobalt-strike_ryuk_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 988 -s 44
  2⤵
  PID:2692