4acf1581ad3341dac2f665a455ad97b3dfebe4cb71e4d7332dd11fdc908c1f8e | Triage

Analysis

max time kernel
187s
max time network
291s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bindevt.dll
Size

444KB
MD5

c66385f22734df81af059da793f19c6e
SHA1

2609d58cc559448aa59233ddf2808122dad30fda
SHA256

af7557e7357cab9d7221adfef4ba657cc46e8e2096fa94eab4ce8d443407018f
SHA512

42d6bb252c9e75b327297362bba8c2a2337a76c406b69bace49c8ef0de914c619a1fad0fb6d165fcf64584223eb93267fe53c717999b855506a960534e24c893
SSDEEP

6144:+7c8Zh3n+eb6n/yMxK4ANV0ulsnWz1fmemDiM94hhXBaF6:+7hZh3+eW/yMxKyulsAmemDilLRH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 3648	444	rundll32.exe	85
PID 444 wrote to memory of 3648	444	rundll32.exe	85
PID 444 wrote to memory of 3648	444	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:3648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads