87456e358fac3b5c8c3c1997cc4b5a4c692073972a08033837f15d022086668c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
31/03/2025, 04:23

Target

2025-03-31_93079de0bd272e60957277651faba8e6_black-basta_cobalt-strike_ryuk_satacom.exe
Size

1.9MB
MD5

93079de0bd272e60957277651faba8e6
SHA1

6881ba19895707f88b3a25dace643ee450d5e978
SHA256

87456e358fac3b5c8c3c1997cc4b5a4c692073972a08033837f15d022086668c
SHA512

127a1db9614d1a0f9da080a83ee260e47eb604baf7f412c690e0f908f27db32620d2bd28a6c4487c99db944a10816db0d035891ca69dc2b3a26001059e1f70f3
SSDEEP

24576:NNI2LXlFLf2uee/0kd+mELBX11GyDXcOSbNpZwGlUR:LnFFytugGlUR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 1916	3060	2025-03-31_93079de0bd272e60957277651faba8e6_black-basta_cobalt-strike_ryuk_satacom.exe	31
PID 3060 wrote to memory of 1916	3060	2025-03-31_93079de0bd272e60957277651faba8e6_black-basta_cobalt-strike_ryuk_satacom.exe	31
PID 3060 wrote to memory of 1916	3060	2025-03-31_93079de0bd272e60957277651faba8e6_black-basta_cobalt-strike_ryuk_satacom.exe	31

C:\Users\Admin\AppData\Local\Temp\2025-03-31_93079de0bd272e60957277651faba8e6_black-basta_cobalt-strike_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-31_93079de0bd272e60957277651faba8e6_black-basta_cobalt-strike_ryuk_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3060 -s 44
  2⤵
  PID:1916