90763987c58647c67fd0c18ec0417c0d480ce9e6a8ad753c879561dfd39900e2 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 13:39

Sharing

Report Analysis Logs

General

Target

Trojan-Ransom.Win32.Cidox.dll
Size

42KB
MD5

e2743432db3d6badcd69fb0118627434
SHA1

6d658eec753d1919a6377fb5737f8fd818173617
SHA256

90763987c58647c67fd0c18ec0417c0d480ce9e6a8ad753c879561dfd39900e2
SHA512

b4c0751d78bfc6d7a8d14de176dae1ee148ddb0485da7d2f413321fa7a573129cabd8e00a9a362edf41eda4d3768edca47cbd7da89e1ed3645498ecc1697a071
SSDEEP

768:4m79USe3fvbI3Dhg0dY2V+xLArpcnXyFMO1o9Iv:OSu3Y9g0dYNtgciFjo2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 992	240	rundll32.exe	28
PID 240 wrote to memory of 992	240	rundll32.exe	28
PID 240 wrote to memory of 992	240	rundll32.exe	28
PID 240 wrote to memory of 992	240	rundll32.exe	28
PID 240 wrote to memory of 992	240	rundll32.exe	28
PID 240 wrote to memory of 992	240	rundll32.exe	28
PID 240 wrote to memory of 992	240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Cidox.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Cidox.dll,#1
  2⤵
  PID:992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/992-56-0x00000000008A0000-0x0000000000976000-memory.dmp

Filesize
856KB

Download