3450807c130b6458cf4ff90fe647faf5c8a8ed4a97c41015abab34a6b87c2f58

Analysis

max time kernel
269s
max time network
322s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:18

Target

bindevt.dll
Size

52KB
MD5

c210a94a31767544ac5e89d59b797254
SHA1

2b718bd5a022e899a9acdd51b86c131ea9bad83c
SHA256

b905a18d36a88fc44a49bcc7b2d91391c1162aeda0981d91286aa89654977e1c
SHA512

f8ff6a839763f49bb56b71bc516357c1a72d2bc4e7e5f9fabbdcddf08c8ab6562f7685a580e55f42bfe1ee861324802a3d4cec7ba19ccc176afc9f76329c763f
SSDEEP

384:jKk9TQsp/0zj3OAPV78tt7l3d0TTwMsKm6jRQnX6MojQWSRkLc0RaPV+8r277eu:jKeTQsio0Zmj3WSRewPVpui/dVtDe

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2720	2536	rundll32.exe	27
PID 2536 wrote to memory of 2720	2536	rundll32.exe	27
PID 2536 wrote to memory of 2720	2536	rundll32.exe	27
PID 2536 wrote to memory of 2720	2536	rundll32.exe	27
PID 2536 wrote to memory of 2720	2536	rundll32.exe	27
PID 2536 wrote to memory of 2720	2536	rundll32.exe	27
PID 2536 wrote to memory of 2720	2536	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:2720