bc7f0f492ecd0942654ba5010c8b877a733e7d9670820a0f1cc9332ce957a512 | Triage

Analysis

max time kernel
176s
max time network
247s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:24

Sharing

Report Analysis Logs

General

Target

bindevt.dll
Size

448KB
MD5

566b5f7f5b1540bc4e0e132e5088e9d9
SHA1

b7dabdb3473bf67b115502cd3f444f6e46063379
SHA256

7d65f6aa049fcf00bae1e5e0a6b53e08c2d89feeb7781f8b48d4858003ac033d
SHA512

4d669f0990e66adcc3054322e5307caaea3160c668845d95e8d202f10772bb30b37697b0c5f09b6cfa97f22ad60698071f4a31929bda27a8105430ffb9ca49fb
SSDEEP

6144:bLyto9KMLecTR/bsUpbm97VQ8873FKBkDORsnb6ZYFNtdHiVXj:bLKo9PLecFTsU9m9E73FSRsnb6+nIj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 4168	2332	rundll32.exe	87
PID 2332 wrote to memory of 4168	2332	rundll32.exe	87
PID 2332 wrote to memory of 4168	2332	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:4168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads