344ec99b745d6a2d9e512758702be6ebfdf60b9df6bfb12fe79ba0a9ced52bfb | Triage

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:22

Sharing

Report Analysis Logs

General

Target

bindevt.dll
Size

52KB
MD5

a2f3dd69bd49e2977d85f670944b17be
SHA1

4db1854b3c10bfac8d50937d7889c6b904cfb923
SHA256

bc9c7be333f9a65932be703b94d0de09dd8fcfa0ad439691a5f2bc9035b7d216
SHA512

94a88937bfe8e0f4e947cfe809b2e9c5f0bd9f64161643654e4d4ed03fde28a5c3937a7aa6dd5c6160db50959ef0ffeb5fee8f4ecdffc583d15db0f3e146ffb9
SSDEEP

768:2XTQ3dz80P3mkj0wWyRepPVJuiNdVtPw:2X4HVj0wWyEB5tP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 2972	852	rundll32.exe	87
PID 852 wrote to memory of 2972	852	rundll32.exe	87
PID 852 wrote to memory of 2972	852	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads