1bae55baa2dfe26ecc9b148bc2c9820ce05e0fbbfe907a3a116aa08546fabe6d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 14:51

Target

mimikatz_trunk/x64/mimilib.dll
Size

36KB
MD5

67651e9d2da634adedbe216948d5f752
SHA1

0731bd320633a6d1ca7835e2bba2c5ee5429b293
SHA256

aef6ce3014add838cf676b57957d630cd2bb15b0c9193cf349bcffecddbc3623
SHA512

88c7de54fd036a3052a49e52a8bb868e1cd67856b8ef1d0f2ad1151f663addf1d9435fb98f83a24cc16ffd832500061b64399c9fe82edcb83404f59daf7bfd47
SSDEEP

768:CsdDjdgqUQv+EAZJimW8ahsNekFkTn5btsnsFfZ9kYeUveejil0g:vU+LuaaQkFkTn5b+sFhW7ejil

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1932	1912	rundll32.exe	28
PID 1912 wrote to memory of 1932	1912	rundll32.exe	28
PID 1912 wrote to memory of 1932	1912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mimikatz_trunk\x64\mimilib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1912 -s 120
  2⤵
  PID:1932