5286e01ea56c6df3702bfb1ce780569d279193d765dd594ebc840bbd91fccc69 | Triage

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 13:44

Sharing

Report Analysis Logs

General

Target

Trojan-Ransom.Win32.Cidox.dll
Size

42KB
MD5

bad384c853f6324f5a3594fbf433e55a
SHA1

c42e17cebd2d8b79724d5ab5e03ceb4ad3b17aa7
SHA256

5286e01ea56c6df3702bfb1ce780569d279193d765dd594ebc840bbd91fccc69
SHA512

3f4d47265c6f6f008ee6fe7451b4dd2b3b87cddac490a5aa156c74d1dfb42e6391c3aa7daf8cd92ff01c3f6865115341317a4cbf5ba907c9c7785a017b8bc4d1
SSDEEP

768:GBEYAF5hYFifGj5X4RCX3UFh51/Kvgu0dcyaO1o9Jl:GC9FakSKBFN/KYjdzBo

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4212	4416	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 4416	4400	rundll32.exe	79
PID 4400 wrote to memory of 4416	4400	rundll32.exe	79
PID 4400 wrote to memory of 4416	4400	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Cidox.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Cidox.dll,#1
  2⤵
  PID:4416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 660
    3⤵
    - Program crash
    PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4416 -ip 4416
1⤵
PID:4704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4416-132-0x0000000000000000-mapping.dmp

Download
memory/4416-133-0x0000000002A10000-0x0000000002AE6000-memory.dmp

Filesize
856KB

Download
memory/4416-134-0x0000000002A10000-0x0000000002AE6000-memory.dmp

Filesize
856KB

Download