73957fd1f888a8f94d3c2396e52cce5ba48b8443960edac35caa1ff4715f51a0 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bindevt.dll
Size

52KB
MD5

d0b5f1a5f6e9802995421d152ade0fbf
SHA1

fe4a2c4ac5fbec5e048439d8d160b91e8233af66
SHA256

ebb9a4c5506fa7ed2eda64690a25d84df5f9cac7d9a0857cd3302c57bd9d7b60
SHA512

e7ee205abfbfef3cea958cd2c17260ef944aa37f9653f194fa7a4cc48bc8429c3acbc25b8633b8d9cf658f7c3c996db007d3639338faad0c3bd1a74df9466dae
SSDEEP

768:sXTQ3dz80P3mkj0wWyRepPVJuiNdVtPw:sX4HVj0wWyEB5tP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2832	2632	rundll32.exe	28
PID 2632 wrote to memory of 2832	2632	rundll32.exe	28
PID 2632 wrote to memory of 2832	2632	rundll32.exe	28
PID 2632 wrote to memory of 2832	2632	rundll32.exe	28
PID 2632 wrote to memory of 2832	2632	rundll32.exe	28
PID 2632 wrote to memory of 2832	2632	rundll32.exe	28
PID 2632 wrote to memory of 2832	2632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads