03c624fea61dd78381058ac1072dec2a40272bd0c200600fad853adcf19a8367 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Iniuria v1.7.9/Iniuria.dll
Size

316KB
MD5

0e7957480475284d355dd470c20259b9
SHA1

4f268ed2cd14dffec87dac797e30387463f6a26d
SHA256

f4ca82b306bd9a3b131f0fde806bc7c66d2506c34d8c5a9e70a0621b60dd7a0e
SHA512

c5e78925ce9b4cd5f2bb60015a363e0168d917025828ceeece12320b8500e11fa3a35c04f6287e165497dff2fa35bd7daf777f86ff04ed032ef54ed507b2c53d
SSDEEP

6144:4/i70ZNXtm8xLjOsWq+aR2p1xAOcIDGIAR:wPxLj5d2BdDaR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 2196	1480	rundll32.exe	28
PID 1480 wrote to memory of 2196	1480	rundll32.exe	28
PID 1480 wrote to memory of 2196	1480	rundll32.exe	28
PID 1480 wrote to memory of 2196	1480	rundll32.exe	28
PID 1480 wrote to memory of 2196	1480	rundll32.exe	28
PID 1480 wrote to memory of 2196	1480	rundll32.exe	28
PID 1480 wrote to memory of 2196	1480	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Iniuria v1.7.9\Iniuria.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Iniuria v1.7.9\Iniuria.dll",#1
  2⤵
  PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2196-0-0x0000000010000000-0x0000000010153000-memory.dmp

Filesize
1.3MB

Download