1f2338d7b628374139d373af383a1bdec1a16b43ced015849c6be4e4d90cc2c3 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 05:05

Sharing

Report Analysis Logs

General

Target

x64/mimilib.dll
Size

36KB
MD5

67651e9d2da634adedbe216948d5f752
SHA1

0731bd320633a6d1ca7835e2bba2c5ee5429b293
SHA256

aef6ce3014add838cf676b57957d630cd2bb15b0c9193cf349bcffecddbc3623
SHA512

88c7de54fd036a3052a49e52a8bb868e1cd67856b8ef1d0f2ad1151f663addf1d9435fb98f83a24cc16ffd832500061b64399c9fe82edcb83404f59daf7bfd47
SSDEEP

768:CsdDjdgqUQv+EAZJimW8ahsNekFkTn5btsnsFfZ9kYeUveejil0g:vU+LuaaQkFkTn5b+sFhW7ejil

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2740 wrote to memory of 2080	2740	rundll32.exe	WerFault.exe
PID 2740 wrote to memory of 2080	2740	rundll32.exe	WerFault.exe
PID 2740 wrote to memory of 2080	2740	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\mimilib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2740 -s 120
2⤵
PID:2080

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...