d19bf611356d319e792ac04e4bc986aa01c8282d942e9de0ae568b0a7d15dc24

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 21:02

Target

x64/mimilib.dll
Size

45KB
MD5

ab9bb7c4b0f50907f5b30e4b1a9d9be1
SHA1

a313253944882ba9c1f8229699f38c750817eb45
SHA256

f6f57fc82399ef3759dcbc16b7a25343dea0b539332dacdf0ed289cc82e900db
SHA512

07e42b589d9e53fcd6353dc1c6fff0727cfc457ebee20596ee18b37d55404738a5000756e97e668bbee5f75a9d337a2e9dfc0fd1e9e1fb90e78a64d5d0883505
SSDEEP

768:leZJr1okqSWZc8A5txt24QHEmclhb7snsFY3+Crf0zlejnl0DQFnzEhzFn2+Eh+:I/K9Are4Qk/lhbosF11lejnlCKzEzbEM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2304	2512	rundll32.exe	31
PID 2512 wrote to memory of 2304	2512	rundll32.exe	31
PID 2512 wrote to memory of 2304	2512	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\mimilib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2512 -s 88
  2⤵
  PID:2304