ba3295ddcae7c88a2f266ce6a9cacbbee18af793088de9540566f8b68ee7848d | Triage

Analysis

max time kernel
118s
max time network
156s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:43

Sharing

Report Analysis Logs

General

Target

bindevt.dll
Size

52KB
MD5

4ea244e8ae848363e082c2aef9a5fbe2
SHA1

72f1b224882927b34a1c196b33beb78252b6dede
SHA256

6c879abb94b4ff0eb1a992ab4e7a0a509b2f789af5751f8f0cd1122aa7717d31
SHA512

de8a0ee553b04ec0f960447f073a83f2985bd56fb0b3b82b6b510511bd9488dcebdf89843c283dc3e5aac2142eefac38c85fe0984695d02090f0314f30da895f
SSDEEP

768:lXTQ3dz80P3mkj0wWyRepPVJuiNdVtPw:lX4HVj0wWyEB5tP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2308	2812	rundll32.exe	29
PID 2812 wrote to memory of 2308	2812	rundll32.exe	29
PID 2812 wrote to memory of 2308	2812	rundll32.exe	29
PID 2812 wrote to memory of 2308	2812	rundll32.exe	29
PID 2812 wrote to memory of 2308	2812	rundll32.exe	29
PID 2812 wrote to memory of 2308	2812	rundll32.exe	29
PID 2812 wrote to memory of 2308	2812	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads