1f2338d7b628374139d373af383a1bdec1a16b43ced015849c6be4e4d90cc2c3 | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 16:37

Sharing

Report Analysis Logs

General

Target

x64/mimilib.dll
Size

36KB
MD5

67651e9d2da634adedbe216948d5f752
SHA1

0731bd320633a6d1ca7835e2bba2c5ee5429b293
SHA256

aef6ce3014add838cf676b57957d630cd2bb15b0c9193cf349bcffecddbc3623
SHA512

88c7de54fd036a3052a49e52a8bb868e1cd67856b8ef1d0f2ad1151f663addf1d9435fb98f83a24cc16ffd832500061b64399c9fe82edcb83404f59daf7bfd47
SSDEEP

768:CsdDjdgqUQv+EAZJimW8ahsNekFkTn5btsnsFfZ9kYeUveejil0g:vU+LuaaQkFkTn5b+sFhW7ejil

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2816 wrote to memory of 2872	2816	rundll32.exe	WerFault.exe
PID 2816 wrote to memory of 2872	2816	rundll32.exe	WerFault.exe
PID 2816 wrote to memory of 2872	2816	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\mimilib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2816 -s 124
  2⤵
  PID:2872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads