Overview
overview
10Static
static
10Win32/mimidrv.exe
windows10-1703-x64
Win32/mimikatz.exe
windows10-1703-x64
1Win32/mimilib.dll
windows10-1703-x64
3Win32/mimilove.exe
windows10-1703-x64
1Win32/mimispool.dll
windows10-1703-x64
1x64/mimidrv.exe
windows10-1703-x64
x64/mimikatz.exe
windows10-1703-x64
1x64/mimilib.dll
windows10-1703-x64
3x64/mimispool.dll
windows10-1703-x64
1Analysis
-
max time kernel
50s -
max time network
70s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
05-10-2022 11:17
Behavioral task
behavioral1
Sample
Win32/mimidrv.exe
Resource
win10-20220901-en
Behavioral task
behavioral2
Sample
Win32/mimikatz.exe
Resource
win10-20220812-en
Behavioral task
behavioral3
Sample
Win32/mimilib.dll
Resource
win10-20220812-en
Behavioral task
behavioral4
Sample
Win32/mimilove.exe
Resource
win10-20220812-en
Behavioral task
behavioral5
Sample
Win32/mimispool.dll
Resource
win10-20220901-en
Behavioral task
behavioral6
Sample
x64/mimidrv.exe
Resource
win10-20220812-en
Behavioral task
behavioral7
Sample
x64/mimikatz.exe
Resource
win10-20220812-en
Behavioral task
behavioral8
Sample
x64/mimilib.dll
Resource
win10-20220812-en
Behavioral task
behavioral9
Sample
x64/mimispool.dll
Resource
win10-20220901-en
General
-
Target
Win32/mimilib.dll
-
Size
31KB
-
MD5
46e598798bdde4c72e796edcf2317b52
-
SHA1
e00efa11ab8464e665f2a1d526e94cca5c71d9fa
-
SHA256
e60c210687e79347d06f9a144ee84417ba9ac4c1f303720f2fe4509734d670d6
-
SHA512
c384fe4cd20dc97b53a26593d30b6c5d8d3665f957019b555bad956cc4e238b50216f47af7fa4ad9bd03d30d323b811aa0e32dcea2e25a9df6855a65dcea9a9d
-
SSDEEP
384:ZPqreMGv6SqMDjuPRjL9sapJcos+uOiZESsQDygQ2Unn7PAss3sWqWyXO4hMnAl3:lrEdpJLFiq3GO7bs3sdEFyQejil0Tn
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1652 3476 WerFault.exe 66 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4124 wrote to memory of 3476 4124 rundll32.exe 66 PID 4124 wrote to memory of 3476 4124 rundll32.exe 66 PID 4124 wrote to memory of 3476 4124 rundll32.exe 66
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Win32\mimilib.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Win32\mimilib.dll,#12⤵PID:3476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 6283⤵
- Program crash
PID:1652
-
-