39d6ca155bf7e3d4030cfe40e5bff8eddb96de137abd1b249fcf58685a26d0b6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 04:42

Target

2024-07-01_24d546bca1487224f61c1d279f02b548_ryuk.exe
Size

1.8MB
MD5

24d546bca1487224f61c1d279f02b548
SHA1

7fd8adb86e4eb4579f990bddf2c4446c0bb2a96a
SHA256

39d6ca155bf7e3d4030cfe40e5bff8eddb96de137abd1b249fcf58685a26d0b6
SHA512

e3f72cd7d16c45a0243ba8bed4fc85cc8bfad66a454f40056ceae919c50e22622b96775bc28b245fefd86800097334aaa0db6fbd84a267b499c27dc969b9bc4d
SSDEEP

49152:KKfuPS3ELNjV7IZxEfOfOgwf03kQ/qoLEw:tm9sZxwgTqo4w

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-07-01_24d546bca1487224f61c1d279f02b548_ryuk.exe

description	pid	process	target process
PID 1040 wrote to memory of 1984	1040	2024-07-01_24d546bca1487224f61c1d279f02b548_ryuk.exe	WerFault.exe
PID 1040 wrote to memory of 1984	1040	2024-07-01_24d546bca1487224f61c1d279f02b548_ryuk.exe	WerFault.exe
PID 1040 wrote to memory of 1984	1040	2024-07-01_24d546bca1487224f61c1d279f02b548_ryuk.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-01_24d546bca1487224f61c1d279f02b548_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-01_24d546bca1487224f61c1d279f02b548_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1040 -s 220
2⤵
PID:1984

memory/1040-6-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Filesize
384KB

Download
memory/1040-0-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Filesize
384KB

Download
memory/1040-9-0x0000000140000000-0x00000001401DF000-memory.dmp

Filesize
1.9MB

Download