mimikatz | d306b7ee485f00703883aec130caea065f3111aeeed685db94023c8137eb8c8b

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 14:27

Target

26781d251b8d8e8485654c7c5c411bc0N.exe
Size

1.4MB
MD5

26781d251b8d8e8485654c7c5c411bc0
SHA1

0eb5f8e8d6d2601c17abb72dd140bea6ec52ca9a
SHA256

d306b7ee485f00703883aec130caea065f3111aeeed685db94023c8137eb8c8b
SHA512

10ec1168db6d97f431db18fe5bde3b823e3cad0cd10e30c55f5213d829d09f9e227067e50bd0ab754e7afe928e4ed25a4e662ccb1f3edd873bd4acb214cc7e27
SSDEEP

24576:pgBVy9toZnT31Ebbb8k+0WOikVEap5ldDGMwRJf+9T4pzg:g2oCr3ikVEapXd0f+9U

Score

10^/10

mimikatz

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/memory/2984-0-0x000000013F2B0000-0x000000013F41A000-memory.dmp	mimikatz

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2516	2984	26781d251b8d8e8485654c7c5c411bc0N.exe	31
PID 2984 wrote to memory of 2516	2984	26781d251b8d8e8485654c7c5c411bc0N.exe	31
PID 2984 wrote to memory of 2516	2984	26781d251b8d8e8485654c7c5c411bc0N.exe	31

C:\Users\Admin\AppData\Local\Temp\26781d251b8d8e8485654c7c5c411bc0N.exe
"C:\Users\Admin\AppData\Local\Temp\26781d251b8d8e8485654c7c5c411bc0N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2984 -s 260
  2⤵
  PID:2516

memory/2984-0-0x000000013F2B0000-0x000000013F41A000-memory.dmp

Filesize
1.4MB

Download