e6b5d9e8c6814b4028034650e5bc498a1cb5d087caa10b0172086f503cbf8365 | Triage

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:31

Sharing

Report Analysis Logs

General

Target

bindevt.dll
Size

448KB
MD5

43c5912b0da8d36cc43fb718dc8da206
SHA1

6d2a0185c43f4303365931d60ae083ee19e5ce88
SHA256

29018df27456f41e6896011b28b47d186186516cceb60456a21e8ca2b4ec490b
SHA512

3f11bf1486f9e1b30c142c8c313f27c2f449be7761bf39cc147f9e6cb70d752877c4be38a48cfef130b56f8be51bd12b9d6f241e98335985673107d41ebb844f
SSDEEP

6144:8Lyto9KMLecTR/bsUpbm97VQ8873FKBkDORsnb6ZYHNydHiVXj:8LKo9PLecFTsU9m9E73FSRsnb6ocIj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2676	2220	rundll32.exe	28
PID 2220 wrote to memory of 2676	2220	rundll32.exe	28
PID 2220 wrote to memory of 2676	2220	rundll32.exe	28
PID 2220 wrote to memory of 2676	2220	rundll32.exe	28
PID 2220 wrote to memory of 2676	2220	rundll32.exe	28
PID 2220 wrote to memory of 2676	2220	rundll32.exe	28
PID 2220 wrote to memory of 2676	2220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:2676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads