c3b2d7948ae93820a30801af64fcecb9974d7845ce2db7f990acbf02e6faa60d | Triage

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Trojan-Ransom.Win32.Cidox.dll
Size

48KB
MD5

1fb7d982ff370782d973c9f6f224ebdd
SHA1

2eae7b188c29b7fbb09588833bd0a0beecc01d20
SHA256

c3b2d7948ae93820a30801af64fcecb9974d7845ce2db7f990acbf02e6faa60d
SHA512

151fe49e71765b272c0cfbaeeaef39fe37a6616608b3909844daa131d08791e35a5153be2b02558f19176b7b001f6a996705f065ebeb9baa7da6e7234d34d082
SSDEEP

768:xifcOpYMO6atXrTbrTxMjiiS1QRMZZMySWXo9r088:nOphO6a9rfrdMjib1OMZZjfoG5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Cidox.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Cidox.dll,#1
  2⤵
  PID:788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/788-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/788-56-0x0000000000660000-0x0000000000736000-memory.dmp

Filesize
856KB

Download