7accd179e8a6b2fc907e7e8d087c52a7f48084852724b03d25bebcada1acbca5 | Triage

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
05-07-2023 11:56

Sharing

Report Analysis Logs

General

Target

x64/mimilib.dll
Size

36KB
MD5

67651e9d2da634adedbe216948d5f752
SHA1

0731bd320633a6d1ca7835e2bba2c5ee5429b293
SHA256

aef6ce3014add838cf676b57957d630cd2bb15b0c9193cf349bcffecddbc3623
SHA512

88c7de54fd036a3052a49e52a8bb868e1cd67856b8ef1d0f2ad1151f663addf1d9435fb98f83a24cc16ffd832500061b64399c9fe82edcb83404f59daf7bfd47
SSDEEP

768:CsdDjdgqUQv+EAZJimW8ahsNekFkTn5btsnsFfZ9kYeUveejil0g:vU+LuaaQkFkTn5b+sFhW7ejil

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2364	2372	WerFault.exe	20

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2364	2372	rundll32.exe	29
PID 2372 wrote to memory of 2364	2372	rundll32.exe	29
PID 2372 wrote to memory of 2364	2372	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\mimilib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2372 -s 124
  2⤵
  - Program crash
  PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads