2a3669aebf4e3d0f217e8094cab6d9694fbcdcf53ea4941275cabcece8180fbd

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-01-2025 13:24

Target

home/maciek/mimikatz/x64/mimilib.dll
Size

56KB
MD5

ddfad0d55be70acdfea36acf28d418b3
SHA1

b82787dc098eefa8bf917f76cfb294ac3f8349f0
SHA256

d9770865ea739a8f1702a2651538f4f4de2d92888d188d8ace2c79936f9c2688
SHA512

887119b149e8df180c395251d2b95be4281f04964074b75d91e4024d3c99b1f5cea4e282ed5597500d8a7e202621d0f6696a6fc1178d110db21659b558fe927a
SSDEEP

1536:LU+LuaaQkFkTn5b7sFhWSejil3UiRoL7SPliuoL7SPA:LFuaGkTn5b7s/WSejilki6fSPliNfSPA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1528	2372	rundll32.exe	30
PID 2372 wrote to memory of 1528	2372	rundll32.exe	30
PID 2372 wrote to memory of 1528	2372	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\home\maciek\mimikatz\x64\mimilib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2372 -s 120
  2⤵
  PID:1528