1f2338d7b628374139d373af383a1bdec1a16b43ced015849c6be4e4d90cc2c3 | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 04:04

Sharing

Report Analysis Logs

General

Target

x64/mimilib.dll
Size

36KB
MD5

67651e9d2da634adedbe216948d5f752
SHA1

0731bd320633a6d1ca7835e2bba2c5ee5429b293
SHA256

aef6ce3014add838cf676b57957d630cd2bb15b0c9193cf349bcffecddbc3623
SHA512

88c7de54fd036a3052a49e52a8bb868e1cd67856b8ef1d0f2ad1151f663addf1d9435fb98f83a24cc16ffd832500061b64399c9fe82edcb83404f59daf7bfd47
SSDEEP

768:CsdDjdgqUQv+EAZJimW8ahsNekFkTn5btsnsFfZ9kYeUveejil0g:vU+LuaaQkFkTn5b+sFhW7ejil

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2832	2772	rundll32.exe	30
PID 2772 wrote to memory of 2832	2772	rundll32.exe	30
PID 2772 wrote to memory of 2832	2772	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\mimilib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2772 -s 124
  2⤵
  PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads