cda8914ac4d824f6553f306ede1a3eb0bc276335d2318b3ebeda3a2ac9d12ec8

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/12/2024, 16:23

Target

mimikatzWindows-master/x64/mimilib.dll
Size

45KB
MD5

eb05429d25fc57b476428cdb0a134b2f
SHA1

1c6913248131b5784b923eff1e76a443f738affc
SHA256

7ffce7f6d7262f214d78e6b7fd8d07119835cba4b04ce334260665d7c8fb369a
SHA512

199cbef36efe00121dbc1e5126ee556a72090c5134f157aa48a89d5ab2b0a15116cb059a7387e5d29dd6a4cab2b584494baf32c9b388118107ab9fa53743bb3f
SSDEEP

768:VWZZrWUCE5KuhECg1kQPbTk/Zm8b4snsFYzltrf0zlejdl0mHFBEhLF3YEhV7K:gP1vgKob4/Zm8bxsFmGlejdl5lBE/IE+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2976	2088	rundll32.exe	30
PID 2088 wrote to memory of 2976	2088	rundll32.exe	30
PID 2088 wrote to memory of 2976	2088	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mimikatzWindows-master\x64\mimilib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2088 -s 88
  2⤵
  PID:2976