mimikatz | a5e989ea89c4e9e37229278101466586cd938a7a18350e78b360ebe083302057

Analysis

max time kernel
93s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 22:07

Target
mimikatz-master/Win32/mimidrv.sys
Size 28KB
Sample240807-11p2jaycre
SHA256 a0931e16cf7b18d15579e36e0a69edad1717b07527b5407f2c105a2f554224b2
MD5 49518f7375a5f995ebe9423d8f19cfe4
SHA1 46c9a474a1a62c25a05bc7661b75a80b471616e6
SHA512 63236cc2b517552ea4e5c8211b2cba5c36f50d40a01c97488f8234a28bc212cdb83e95d1e829b591ff1cb4d4f3bd79a79a0e32aca7cb73077f80fb6d14a55e7f
SSDEEP 384:ji91BwAaJmCH6wseck/+5f2AWyzJJ5cF/7fZ+B8YluynVYEH5C+vdUb+se:jiHyA4sLMyNJ5+zfZ+B8YluyVHZC5ise
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mimikatz

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral2/memory/3904-0-0x0000000000010000-0x000000000001B000-memory.dmp	mimikatz

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\mimikatz-master\Win32\mimidrv.sys
1⤵
PID:756
- C:\Users\Admin\AppData\Local\Temp\mimikatz-master\Win32\mimidrv.sys
  C:\Users\Admin\AppData\Local\Temp\mimikatz-master\Win32\mimidrv.sys
  2⤵
  PID:3904

memory/3904-0-0x0000000000010000-0x000000000001B000-memory.dmp

Download