32b3de101db198c0bdc8c0fcc2feaa079e2d9ffeb5b2624819efd997e0c67775 | Triage

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 14:07

Sharing

Report Analysis Logs

General

Target

Trojan-Ransom.Win32.Cidox.dll
Size

56KB
MD5

8fab766a2afb1309659900cc2599f2a0
SHA1

219acd2df4409d9c7c4fd1659b8f80e43aa0d937
SHA256

32b3de101db198c0bdc8c0fcc2feaa079e2d9ffeb5b2624819efd997e0c67775
SHA512

ecef7332ccb34663d58d13f7da47efcaa2433929b752e36c2c8d29c979b49f113e348fad7e2f9cdfcd40d821996dc265a11f350125515c59a74f521b1f2282a7
SSDEEP

768:MN/qmKR2yeRXo9XmyHeR7LHIpuaB9soW:MN/rKRpMoAkQXBm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 1184	4800	rundll32.exe	83
PID 4800 wrote to memory of 1184	4800	rundll32.exe	83
PID 4800 wrote to memory of 1184	4800	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Cidox.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Cidox.dll,#1
  2⤵
  PID:1184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-132-0x0000000000000000-mapping.dmp

Download
memory/1184-133-0x00000000021F0000-0x00000000022C6000-memory.dmp

Filesize
856KB

Download