bd25db25437dd60f2e485c5a965dce9b197ffb3b523dc2960dcdd042dc4dda39 | Triage

Analysis

max time kernel
89s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:22

Sharing

Report Analysis Logs

General

Target

bindevt.dll
Size

52KB
MD5

a6f09be7b0041759f978d6bfc139aef3
SHA1

783e58eb16d96b0575c50112686534d3894d6143
SHA256

f0d34ee2ea63f3683628eb6b854b38010084e2c6d32c2d83d57a4054917e442d
SHA512

fb191aeda11081313b351ba7ef97ea37e93097dc08ac8f553257fc7107321409bb2bd48ee6c605273b549b7addd6e5996ed74895d6db9f49ee3f5b5d772d8814
SSDEEP

768:EXTQ3dz80P3mkj0wWyRepPVJuiNdVtPw:EX4HVj0wWyEB5tP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4112	4316	rundll32.exe	84
PID 4316 wrote to memory of 4112	4316	rundll32.exe	84
PID 4316 wrote to memory of 4112	4316	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:4112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads