chaos | 0c7dc8232e38db06a2d6ae99c4e1e3f947981a2a67712e3b28488ebdc92c7cf4

Analysis

user interaction
yes
max time kernel
16s
max time network
22s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 15:19

Target
Crypted(1).exe
Size 80.0MB
Sample261110-sql8wsyz7n
SHA256 0c7dc8232e38db06a2d6ae99c4e1e3f947981a2a67712e3b28488ebdc92c7cf4
MD5 b9d30a1b78df6f7f562740187318939e
SHA1 a7db068b5fff4e4816be055c4485fcf408c35a44
SHA512 3f038baed076135ee8f09368a1617366b7e48bdb81040a26bb87da5bc9845fde0cb85b2e3cb821b6fc030545f4e668628dc81d0fbaeeb15366b82af8461b974b
SSDEEP 49152:JweUnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnX:dUX
TLSH
T1DB0802A2BF09BBCBCAF94BB4310AA5842C55031CDB196F4009B7B7BCD395907A35953B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

chaos ransomware

Chaos Ransomware 2 IoCs

resource	yara_rule
behavioral1/memory/4672-2-0x0000000000400000-0x0000000000448000-memory.dmp	family_chaos
behavioral1/memory/2852-3-0x0000000140000000-0x0000000140097000-memory.dmp	family_chaos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2852 set thread context of 4672	2852	Crypted(1).exe	86

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 4672	2852	Crypted(1).exe	86
PID 2852 wrote to memory of 4672	2852	Crypted(1).exe	86
PID 2852 wrote to memory of 4672	2852	Crypted(1).exe	86
PID 2852 wrote to memory of 4672	2852	Crypted(1).exe	86
PID 2852 wrote to memory of 4672	2852	Crypted(1).exe	86
PID 2852 wrote to memory of 4672	2852	Crypted(1).exe	86

C:\Users\Admin\AppData\Local\Temp\Crypted(1).exe
"C:\Users\Admin\AppData\Local\Temp\Crypted(1).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe"
  2⤵
  PID:4672

memory/2852-0-0x0000000140000000-0x0000000140097000-memory.dmp

Download

memory/2852-1-0x00007FF882130000-0x00007FF882325000-memory.dmp

Download

memory/2852-3-0x0000000140000000-0x0000000140097000-memory.dmp

Download

memory/4672-2-0x0000000000400000-0x0000000000448000-memory.dmp

Download