f054d07dccf8f200ea3838160e34aedceb0c7111d1434e6f0863f610e574a460 | Triage

Analysis

max time kernel
126s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 13:59

Sharing

Report Analysis Logs

General

Target

bindevt.dll
Size

448KB
MD5

c35867a3c92fc45b0d6e8cc5c3cf3d97
SHA1

4c111318b9c5a92370af38755a15cd9bb1437c75
SHA256

045dc3badea4f221553fcd8c9c972a88e1bd831a3a91017606e501f876469074
SHA512

bdf595f4e56b71e9d98a3ad5070d3777c781c8c034bd7587ea4f7eda4778f4c76521d1c197dfc22755030d4d1884fc92eff186c3205166fba5e8d9bc42bb6a77
SSDEEP

6144:4Lyto9KMLecTR/bsUpbm97VQ8873FKBkDORsnb6ZYcZGdHiVXj:4LKo9PLecFTsU9m9E73FSRsnb6PMIj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 756	2424	rundll32.exe	86
PID 2424 wrote to memory of 756	2424	rundll32.exe	86
PID 2424 wrote to memory of 756	2424	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads