0ad89051c06b4a5cd4bb2e6c4503adc957d0962b0388e811f07bcaebb4146bac | Triage

Analysis

max time kernel
7s
max time network
37s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:08

Sharing

Report Analysis Logs

General

Target

bindevt.dll
Size

444KB
MD5

9c21a914fd82ee3dc996a1e7703644fd
SHA1

b7aa33dc48411e25d7255af66f2bedcf30eab454
SHA256

17e5fc2b1abe2cf770db09342f82a877a87b204d1f9127b0e1b9367c4d5b02b0
SHA512

3846464237f354a8625a4250e4164aa3b4da676b27fce042ff9dac00525fbc99bfbb89811ebf7f9beee781e70e86b6d7f0ba481a736489fde710fe4b5cbd01f4
SSDEEP

6144:s7cfZ23n+eb6n/ylxK4ANV0ulNnWz5fx+mDiM9YtMbOBaF6:s7OZ23+eW/ylxKyulNMx+mDiJKbqH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2336	2784	rundll32.exe	30
PID 2784 wrote to memory of 2336	2784	rundll32.exe	30
PID 2784 wrote to memory of 2336	2784	rundll32.exe	30
PID 2784 wrote to memory of 2336	2784	rundll32.exe	30
PID 2784 wrote to memory of 2336	2784	rundll32.exe	30
PID 2784 wrote to memory of 2336	2784	rundll32.exe	30
PID 2784 wrote to memory of 2336	2784	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:2336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads