bc7f0f492ecd0942654ba5010c8b877a733e7d9670820a0f1cc9332ce957a512 | Triage

Analysis

max time kernel
121s
max time network
155s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:24

Sharing

Report Analysis Logs

General

Target

bindevt.dll
Size

448KB
MD5

566b5f7f5b1540bc4e0e132e5088e9d9
SHA1

b7dabdb3473bf67b115502cd3f444f6e46063379
SHA256

7d65f6aa049fcf00bae1e5e0a6b53e08c2d89feeb7781f8b48d4858003ac033d
SHA512

4d669f0990e66adcc3054322e5307caaea3160c668845d95e8d202f10772bb30b37697b0c5f09b6cfa97f22ad60698071f4a31929bda27a8105430ffb9ca49fb
SSDEEP

6144:bLyto9KMLecTR/bsUpbm97VQ8873FKBkDORsnb6ZYFNtdHiVXj:bLKo9PLecFTsU9m9E73FSRsnb6+nIj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2824	2516	rundll32.exe	28
PID 2516 wrote to memory of 2824	2516	rundll32.exe	28
PID 2516 wrote to memory of 2824	2516	rundll32.exe	28
PID 2516 wrote to memory of 2824	2516	rundll32.exe	28
PID 2516 wrote to memory of 2824	2516	rundll32.exe	28
PID 2516 wrote to memory of 2824	2516	rundll32.exe	28
PID 2516 wrote to memory of 2824	2516	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:2824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads