0e4a27511855dd527266f514add9dde5261d83cd7384f0efc6b6f96f76e2f31f | Triage

Analysis

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bindevt.dll
Size

52KB
MD5

1667e8b3bf470780021daf99930fc609
SHA1

33872daeb16f95200c5c209ac0b46f5a697f4a2a
SHA256

d9a68dab2daf8031c1bd5f8e5ff1f7b822a4cfc9fb550514106bb74d3b4531a3
SHA512

117fdaeaedaa61734a72534e0de843d1313961bc44592f781798762d738a4c152b8e957f1e28e3c50a67f5b2aab4f4628d4018fc467d218b11ccaccf47aa51c8
SSDEEP

768:BXTQ3dz80P3mkj0wWyRepPVJuiNdVtPw:BX4HVj0wWyEB5tP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 3012	2476	rundll32.exe	28
PID 2476 wrote to memory of 3012	2476	rundll32.exe	28
PID 2476 wrote to memory of 3012	2476	rundll32.exe	28
PID 2476 wrote to memory of 3012	2476	rundll32.exe	28
PID 2476 wrote to memory of 3012	2476	rundll32.exe	28
PID 2476 wrote to memory of 3012	2476	rundll32.exe	28
PID 2476 wrote to memory of 3012	2476	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads