19b47dc190de5dfe23e74a7dc3a96e5a1473ab25541ffe963059ff98085796ca | Triage

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:23

Sharing

Report Analysis Logs

General

Target

bindevt.dll
Size

448KB
MD5

160a8ef65e14d37cdbe14e149c33629c
SHA1

465f28502d8a4eaf9b2368e6fe5509ac629e3460
SHA256

2e926397b3d9353b7b3097e88894ad6bc1c38a24929e8935aef594d16c7895c9
SHA512

9b6e8d2ae7d9383c44cedeb599a0ae7ed068567ec576168e89a679568dd0bb963a9b84ad1907a6211a2eb4aafb5fa36115c7659703afc84e0bfe7f4c452ae16c
SSDEEP

6144:BLyto9KMLecTR/bsUpbm97VQ8873FKBkDORsnb6ZYjNIdHiVXj:BLKo9PLecFTsU9m9E73FSRsnb6QSIj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2888	2684	rundll32.exe	29
PID 2684 wrote to memory of 2888	2684	rundll32.exe	29
PID 2684 wrote to memory of 2888	2684	rundll32.exe	29
PID 2684 wrote to memory of 2888	2684	rundll32.exe	29
PID 2684 wrote to memory of 2888	2684	rundll32.exe	29
PID 2684 wrote to memory of 2888	2684	rundll32.exe	29
PID 2684 wrote to memory of 2888	2684	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads