5286e01ea56c6df3702bfb1ce780569d279193d765dd594ebc840bbd91fccc69 | Triage

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 13:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Trojan-Ransom.Win32.Cidox.dll
Size

42KB
MD5

bad384c853f6324f5a3594fbf433e55a
SHA1

c42e17cebd2d8b79724d5ab5e03ceb4ad3b17aa7
SHA256

5286e01ea56c6df3702bfb1ce780569d279193d765dd594ebc840bbd91fccc69
SHA512

3f4d47265c6f6f008ee6fe7451b4dd2b3b87cddac490a5aa156c74d1dfb42e6391c3aa7daf8cd92ff01c3f6865115341317a4cbf5ba907c9c7785a017b8bc4d1
SSDEEP

768:GBEYAF5hYFifGj5X4RCX3UFh51/Kvgu0dcyaO1o9Jl:GC9FakSKBFN/KYjdzBo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27
PID 1492 wrote to memory of 1124	1492	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Cidox.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Cidox.dll,#1
  2⤵
  PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1124-56-0x0000000001EA0000-0x0000000001F76000-memory.dmp

Filesize
856KB

Download