f9a9e358665b076dc9d8080430d20b31b5da4d6fe4664176bc323909a1c2bf65 | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 13:56

Sharing

Report Analysis Logs

General

Target

bindevt.dll
Size

448KB
MD5

fee4f99357b8415fd9c00779e0e020e1
SHA1

a6e6d34179424219b3235c29b5ce2d3d59c17766
SHA256

6dc0c448fa837b5daa1e9ba1039b1f00dd6afe7dc7628521153ff8d91d50081f
SHA512

87d1f217ced4a9861b2e2ba57272b99694c29de62dc5d2b3efb30ef70fe9988fc55990f16ec7149e3cb702ee6ca842191744524e483c1ffc0b5b4094f839dc16
SSDEEP

6144:zLyto9KMLecTR/bsUpbm97VQ8873FKBkDORsnb6ZYJN4dHiVXj:zLKo9PLecFTsU9m9E73FSRsnb62mIj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 1580	2796	rundll32.exe	28
PID 2796 wrote to memory of 1580	2796	rundll32.exe	28
PID 2796 wrote to memory of 1580	2796	rundll32.exe	28
PID 2796 wrote to memory of 1580	2796	rundll32.exe	28
PID 2796 wrote to memory of 1580	2796	rundll32.exe	28
PID 2796 wrote to memory of 1580	2796	rundll32.exe	28
PID 2796 wrote to memory of 1580	2796	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:1580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads