d86e5d2701b548dfbe0419bcffb2ae82c6ccdeb6dc9612050273c543a6f5215a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-11-2024 22:09

Target

mimikatz-master/x64/mimilib.dll
Size

45KB
MD5

eb05429d25fc57b476428cdb0a134b2f
SHA1

1c6913248131b5784b923eff1e76a443f738affc
SHA256

7ffce7f6d7262f214d78e6b7fd8d07119835cba4b04ce334260665d7c8fb369a
SHA512

199cbef36efe00121dbc1e5126ee556a72090c5134f157aa48a89d5ab2b0a15116cb059a7387e5d29dd6a4cab2b584494baf32c9b388118107ab9fa53743bb3f
SSDEEP

768:VWZZrWUCE5KuhECg1kQPbTk/Zm8b4snsFYzltrf0zlejdl0mHFBEhLF3YEhV7K:gP1vgKob4/Zm8bxsFmGlejdl5lBE/IE+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 808	2124	rundll32.exe	30
PID 2124 wrote to memory of 808	2124	rundll32.exe	30
PID 2124 wrote to memory of 808	2124	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mimikatz-master\x64\mimilib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2124 -s 88
  2⤵
  PID:808