374bec44744d1a5bf3ba7f9fdcab61f6e7bc9d748535d491119cf9c010f9222d

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/03/2025, 06:59

Target

2025-03-31_b909c5c9651fa47d445718066795926b_black-basta_cobalt-strike_ryuk_satacom.exe
Size

1.9MB
MD5

b909c5c9651fa47d445718066795926b
SHA1

c93031fac22a12b64dee3c745dd6d31ca35ea484
SHA256

374bec44744d1a5bf3ba7f9fdcab61f6e7bc9d748535d491119cf9c010f9222d
SHA512

691fd17a2a9e2db4e4e41c96c4d0825037d34bcf8920d3bcd70dd787bfc7e942f1f3ea6542a80793c8474a04ffcb213f75887d604eeec9e4bce7cbddd20c460a
SSDEEP

24576:NNI2LXlFLf2uee/0kd+mELBX11GyDXcOSbNpZwulUR:LnFFytugulUR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 1952	2356	2025-03-31_b909c5c9651fa47d445718066795926b_black-basta_cobalt-strike_ryuk_satacom.exe	30
PID 2356 wrote to memory of 1952	2356	2025-03-31_b909c5c9651fa47d445718066795926b_black-basta_cobalt-strike_ryuk_satacom.exe	30
PID 2356 wrote to memory of 1952	2356	2025-03-31_b909c5c9651fa47d445718066795926b_black-basta_cobalt-strike_ryuk_satacom.exe	30

C:\Users\Admin\AppData\Local\Temp\2025-03-31_b909c5c9651fa47d445718066795926b_black-basta_cobalt-strike_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-31_b909c5c9651fa47d445718066795926b_black-basta_cobalt-strike_ryuk_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2356 -s 44
  2⤵
  PID:1952