6720eedcf1c4f6b62bc8a47121a63edc9001d510a2aea5a8046dcc8f6d2b1acf | Triage

Analysis

max time kernel
128s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bindevt.dll
Size

448KB
MD5

956c4282a920fe5d2b7936d355d24da7
SHA1

5e33f1d24fd2ab6a706186812e7cb50eb8559d73
SHA256

8e2664f68351eb390c0bdfb51e6101af26314d078628ffcc1a12b403a2cc9183
SHA512

13e51a93965a855223f6b778a4b43e4c0a78e321a1a2735b54e4c80139448ae967023ca05ac86b6660ef17f3c3acdd36af6f955dd33325dda5d8ce29d58d5a61
SSDEEP

6144:gLyto9KMLecTR/bsUpbm97VQ8873FKBkDORsnb6ZYoN3dHiVXj:gLKo9PLecFTsU9m9E73FSRsnb6ntIj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 3144	4960	rundll32.exe	87
PID 4960 wrote to memory of 3144	4960	rundll32.exe	87
PID 4960 wrote to memory of 3144	4960	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:3144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads