6f58385cad88ec38d604b854133e41b70e4486858f10306cfc8bacc716d3f53e

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 14:17

Target

Trojan-Ransom.Win32.Cidox.dll
Size

60KB
MD5

07c6835f41f1e2723c7b8f93d7a35f0a
SHA1

140b3857612c457a58bcaa58e1903aab80d716c0
SHA256

6f58385cad88ec38d604b854133e41b70e4486858f10306cfc8bacc716d3f53e
SHA512

d42f821eceb5915426664b7beb462a61c48fa1afc65429758610caa2cd87d0574c218db87e4382a1a5758c8dbb0a215593454e2aacdcbc5ffa400b92ce56095c
SSDEEP

768:hN2kmZzEo8fwrsvycHQo1i0Il7yghXo9xlIluOfwC1KvXqiNUcQm5IwO9aL:hGRE5f8svp31F+WWoNIc7jX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 2180	4076	rundll32.exe	43
PID 4076 wrote to memory of 2180	4076	rundll32.exe	43
PID 4076 wrote to memory of 2180	4076	rundll32.exe	43

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Cidox.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Cidox.dll,#1
  2⤵
  PID:2180

memory/2180-132-0x0000000000000000-mapping.dmp

Download
memory/2180-133-0x0000000002A40000-0x0000000002B16000-memory.dmp

Filesize
856KB

Download