mimikatz | 7accd179e8a6b2fc907e7e8d087c52a7f48084852724b03d25bebcada1acbca5

Analysis

max time kernel
0s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29-03-2023 17:41

Sharing

Reason

platform exec: image=C:\Users\Admin\AppData\Local\Temp\Win32\mimidrv.exe command="C:\Users\Admin\AppData\Local\Temp\Win32\mimidrv.exe" wdir=C:\Users\Admin\AppData\Local\Temp\Win32 Payload error: The %1 application cannot be run in Win32 mode.

Report Analysis Logs

General

Target

Win32/mimidrv.exe
Size

29KB
MD5

0818699d065afcb1f397d578d3708dc2
SHA1

df107aa0214b914c645967eddff6fdda88152eba
SHA256

4ff7578df7293e50c9bdd48657a6ba0c60e1f6d06a2dd334f605af34fe6f75a5
SHA512

f6f89627a1be33788d576acebf16d36fbfa1b6f89d8cb9191771146231ccb5d77af11aa70640813e473872c83171cc4606f490d16d1bce322926046a5bc80cdd
SSDEEP

768:Bk0ByYHIVcmG9yJao/fZ+B8zlu7TVHZC5is5c:BZyYGG92LHMB8zl8TJwism

Score

10^/10

mimikatz

Malware Config

Signatures

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/memory/1260-54-0x0000000000010000-0x000000000001B000-memory.dmp	mimikatz

C:\Users\Admin\AppData\Local\Temp\Win32\mimidrv.exe
"C:\Users\Admin\AppData\Local\Temp\Win32\mimidrv.exe"
1⤵
PID:1260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1260-54-0x0000000000010000-0x000000000001B000-memory.dmp

Filesize
44KB

Download