0e4a27511855dd527266f514add9dde5261d83cd7384f0efc6b6f96f76e2f31f | Triage

Analysis

max time kernel
145s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 13:45

Sharing

Report Analysis Logs

General

Target

bindevt.dll
Size

52KB
MD5

1667e8b3bf470780021daf99930fc609
SHA1

33872daeb16f95200c5c209ac0b46f5a697f4a2a
SHA256

d9a68dab2daf8031c1bd5f8e5ff1f7b822a4cfc9fb550514106bb74d3b4531a3
SHA512

117fdaeaedaa61734a72534e0de843d1313961bc44592f781798762d738a4c152b8e957f1e28e3c50a67f5b2aab4f4628d4018fc467d218b11ccaccf47aa51c8
SSDEEP

768:BXTQ3dz80P3mkj0wWyRepPVJuiNdVtPw:BX4HVj0wWyEB5tP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1644	2032	rundll32.exe	90
PID 2032 wrote to memory of 1644	2032	rundll32.exe	90
PID 2032 wrote to memory of 1644	2032	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads