036dff7ca8aafa5e3a75fc8637d3db045f351e124b51e7b9f0c780ddb30e8bbc

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 13:56

Target

Trojan-Ransom.Win32.Cidox.dll
Size

60KB
MD5

f422856c99494ab28584ff47afb5d88a
SHA1

bc3969069b083384fd6f9c2a71de33ca7ddf87ff
SHA256

036dff7ca8aafa5e3a75fc8637d3db045f351e124b51e7b9f0c780ddb30e8bbc
SHA512

cc3dc317fe026133d558ed2fcdd0d59396cdd54b8c34e33dd0f9c26d5059b03f856598804994b1d3df78099b03192693a7a19741fb78d26bf42f8739bbf84b01
SSDEEP

768:DZzEo8fwrovycHQJ3dVj/ElTyBDXo9Pm2shUIVzzgx66xJgFaZnTw:DRE5f8ovpe3dVj/IO5oA2WUwzWc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26
PID 2012 wrote to memory of 1920	2012	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Cidox.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Cidox.dll,#1
  2⤵
  PID:1920

memory/1920-55-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download
memory/1920-56-0x0000000001D00000-0x0000000001DD6000-memory.dmp

Filesize
856KB

Download