87456e358fac3b5c8c3c1997cc4b5a4c692073972a08033837f15d022086668c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/03/2025, 04:20

Target

2025-03-31_93079de0bd272e60957277651faba8e6_black-basta_cobalt-strike_ryuk_satacom.exe
Size

1.9MB
MD5

93079de0bd272e60957277651faba8e6
SHA1

6881ba19895707f88b3a25dace643ee450d5e978
SHA256

87456e358fac3b5c8c3c1997cc4b5a4c692073972a08033837f15d022086668c
SHA512

127a1db9614d1a0f9da080a83ee260e47eb604baf7f412c690e0f908f27db32620d2bd28a6c4487c99db944a10816db0d035891ca69dc2b3a26001059e1f70f3
SSDEEP

24576:NNI2LXlFLf2uee/0kd+mELBX11GyDXcOSbNpZwGlUR:LnFFytugGlUR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2688	2672	2025-03-31_93079de0bd272e60957277651faba8e6_black-basta_cobalt-strike_ryuk_satacom.exe	30
PID 2672 wrote to memory of 2688	2672	2025-03-31_93079de0bd272e60957277651faba8e6_black-basta_cobalt-strike_ryuk_satacom.exe	30
PID 2672 wrote to memory of 2688	2672	2025-03-31_93079de0bd272e60957277651faba8e6_black-basta_cobalt-strike_ryuk_satacom.exe	30

C:\Users\Admin\AppData\Local\Temp\2025-03-31_93079de0bd272e60957277651faba8e6_black-basta_cobalt-strike_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-31_93079de0bd272e60957277651faba8e6_black-basta_cobalt-strike_ryuk_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2672 -s 44
  2⤵
  PID:2688