8fb0ce88b39069c7424c64ab9d30b3b8daa5da9fdb72a52d31f45b494a8eadcd

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 14:20

Target

data/meterpreter/ext_server_mimikatz.x64.dll
Size

528KB
MD5

6dc538886b4da00472d2aa06b8aa277a
SHA1

dccfeecef8bf63ae3091ac32368406a8ae0ba8b8
SHA256

2d1ccf661f08f2dbdf754ca24d7cdf6bbe59b766519de4f1b09d1ded83a25818
SHA512

ca5e792faf85e81aa32056f8ce4388adf066691964d3c7aac8f0bba8191fd449644167d699d8c7aa941a3d0fb32c71e1d0fad06e8d23ba6dcb729b7c33a39432
SSDEEP

12288:2nQolfG7VvCiuA+bt0kHYCs0+6skW4UdDSNz0ArRujyplx3yox0e4god:2nQolTskskW4UERMeplx3bod

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2404	2924	rundll32.exe	31
PID 2924 wrote to memory of 2404	2924	rundll32.exe	31
PID 2924 wrote to memory of 2404	2924	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\meterpreter\ext_server_mimikatz.x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2924 -s 160
  2⤵
  PID:2404