3a988e442285b36fb8b471da5ff81bd5d1ef2971fc2f991018bf1d51c98e9a20 | Triage

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:03

Sharing

Report Analysis Logs

General

Target

bindevt.dll
Size

444KB
MD5

cde073c2a57eb1e8061768867040b11c
SHA1

a1ec7f57dad70709f8283b8aae9570e5d811dc7c
SHA256

5db6783d02dbff36267d02661c9dcfc579e98f98bb8a85cd188d6af0dd105b85
SHA512

875f5b5ed0512e4516dd14241b6031b79b4b304f09480cd1e8046fd439f6e510cfd8efd45c592854ddfb23e161dff8b06d2087ea0d20304e67f20f6019d1d30a
SSDEEP

6144:U7cfZ23n+eb6n/ylxK4ANV0ulNnWz5fx+mDiM9yl1OBaF6:U7OZ23+eW/ylxKyulNMx+mDiH/qH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 4728	1332	rundll32.exe	85
PID 1332 wrote to memory of 4728	1332	rundll32.exe	85
PID 1332 wrote to memory of 4728	1332	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:4728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads