73957fd1f888a8f94d3c2396e52cce5ba48b8443960edac35caa1ff4715f51a0 | Triage

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 13:59

Sharing

Report Analysis Logs

General

Target

bindevt.dll
Size

52KB
MD5

d0b5f1a5f6e9802995421d152ade0fbf
SHA1

fe4a2c4ac5fbec5e048439d8d160b91e8233af66
SHA256

ebb9a4c5506fa7ed2eda64690a25d84df5f9cac7d9a0857cd3302c57bd9d7b60
SHA512

e7ee205abfbfef3cea958cd2c17260ef944aa37f9653f194fa7a4cc48bc8429c3acbc25b8633b8d9cf658f7c3c996db007d3639338faad0c3bd1a74df9466dae
SSDEEP

768:sXTQ3dz80P3mkj0wWyRepPVJuiNdVtPw:sX4HVj0wWyEB5tP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 3500	1576	rundll32.exe	88
PID 1576 wrote to memory of 3500	1576	rundll32.exe	88
PID 1576 wrote to memory of 3500	1576	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:3500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads