6f58385cad88ec38d604b854133e41b70e4486858f10306cfc8bacc716d3f53e

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 14:17

Target

Trojan-Ransom.Win32.Cidox.dll
Size

60KB
MD5

07c6835f41f1e2723c7b8f93d7a35f0a
SHA1

140b3857612c457a58bcaa58e1903aab80d716c0
SHA256

6f58385cad88ec38d604b854133e41b70e4486858f10306cfc8bacc716d3f53e
SHA512

d42f821eceb5915426664b7beb462a61c48fa1afc65429758610caa2cd87d0574c218db87e4382a1a5758c8dbb0a215593454e2aacdcbc5ffa400b92ce56095c
SSDEEP

768:hN2kmZzEo8fwrsvycHQo1i0Il7yghXo9xlIluOfwC1KvXqiNUcQm5IwO9aL:hGRE5f8svp31F+WWoNIc7jX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 692	1392	rundll32.exe	22
PID 1392 wrote to memory of 692	1392	rundll32.exe	22
PID 1392 wrote to memory of 692	1392	rundll32.exe	22
PID 1392 wrote to memory of 692	1392	rundll32.exe	22
PID 1392 wrote to memory of 692	1392	rundll32.exe	22
PID 1392 wrote to memory of 692	1392	rundll32.exe	22
PID 1392 wrote to memory of 692	1392	rundll32.exe	22

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Cidox.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Cidox.dll,#1
  2⤵
  PID:692

memory/692-54-0x0000000000000000-mapping.dmp

Download
memory/692-55-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/692-56-0x0000000000930000-0x0000000000A06000-memory.dmp

Filesize
856KB

Download