mimikatz | e058280f4b15c1be6488049e0bdba555f1baf42e139b7251d6b2c230e28e0aef

Analysis

Target
32bit_decompressed.dll
Size 68KB
Sample210317-yfsynbk6qe
SHA256 e058280f4b15c1be6488049e0bdba555f1baf42e139b7251d6b2c230e28e0aef
MD5 9774b2e5e34269bc3adc01d73bdfa76a
SHA1 adc27dc8a9e33cc2c7684bf47d5cc98d0bdc7958
SHA512 90cefd6e4836d4a26f59f551a33a5b4d1cd45891156211e706ad72d16539a3dacda3da69c796e70b3bb6d141820ec2ac2d063a58657a27067f4662d3fa7b7516
MD5 SHA1 SHA512

Score

10^/10

mimikatz

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral2/memory/1068-3-0x00000000741C0000-0x00000000741D4000-memory.dmp	mimikatz

Blocklisted process makes network request 5 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 504 wrote to memory of 1068	504	rundll32.exe	70
PID 504 wrote to memory of 1068	504	rundll32.exe	70
PID 504 wrote to memory of 1068	504	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit_decompressed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit_decompressed.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1068

memory/1068-3-0x00000000741C0000-0x00000000741D4000-memory.dmp

Download