53a1711b7e60f295344a34a3722ff039c39f71342ca9c27f817a5ef08ae9265f | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:07

Sharing

Report Analysis Logs

General

Target

bindevt.dll
Size

52KB
MD5

4834c4ccffa7b1ca35dc6d7c21c7ed2e
SHA1

567431eb0204c8dff43251843edb3d2863727fb5
SHA256

46d125bf33c9d783a3db522309d230da09dd55754b17b5277758a98e64f43b90
SHA512

3c7a05c330f9e5cc0575163a6fc4559fe74b80c26c346d106ae847516e37d25d7aa20a6e8f8c97426bda852aed66b50917129df70e2cf552de59b9b3b7650cc7
SSDEEP

768:3XTQ3dz80P3mkj0wWyRepPVJuiNdVtPw:3X4HVj0wWyEB5tP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 1996	1920	rundll32.exe	28
PID 1920 wrote to memory of 1996	1920	rundll32.exe	28
PID 1920 wrote to memory of 1996	1920	rundll32.exe	28
PID 1920 wrote to memory of 1996	1920	rundll32.exe	28
PID 1920 wrote to memory of 1996	1920	rundll32.exe	28
PID 1920 wrote to memory of 1996	1920	rundll32.exe	28
PID 1920 wrote to memory of 1996	1920	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads