036dff7ca8aafa5e3a75fc8637d3db045f351e124b51e7b9f0c780ddb30e8bbc

Analysis

max time kernel
129s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 13:56

Target

Trojan-Ransom.Win32.Cidox.dll
Size

60KB
MD5

f422856c99494ab28584ff47afb5d88a
SHA1

bc3969069b083384fd6f9c2a71de33ca7ddf87ff
SHA256

036dff7ca8aafa5e3a75fc8637d3db045f351e124b51e7b9f0c780ddb30e8bbc
SHA512

cc3dc317fe026133d558ed2fcdd0d59396cdd54b8c34e33dd0f9c26d5059b03f856598804994b1d3df78099b03192693a7a19741fb78d26bf42f8739bbf84b01
SSDEEP

768:DZzEo8fwrovycHQJ3dVj/ElTyBDXo9Pm2shUIVzzgx66xJgFaZnTw:DRE5f8ovpe3dVj/IO5oA2WUwzWc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1712	632	rundll32.exe	82
PID 632 wrote to memory of 1712	632	rundll32.exe	82
PID 632 wrote to memory of 1712	632	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Cidox.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Cidox.dll,#1
  2⤵
  PID:1712

memory/1712-132-0x0000000000000000-mapping.dmp

Download
memory/1712-133-0x0000000002B50000-0x0000000002C26000-memory.dmp

Filesize
856KB

Download