d9b9820b03a2081f5575b05314fc7298b8a7d37250d40da04614e683607fd95f | Triage

Analysis

max time kernel
134s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:33

Sharing

Report Analysis Logs

General

Target

bindevt.dll
Size

448KB
MD5

432170879c1fa0e0fba90cd001a5f218
SHA1

818c4f72977448e4c2b4f63f199a90bfed9268df
SHA256

0742b6d6dd6b5e8ff8c628dae3a872e9328544e82237acff186b19937360b392
SHA512

38117c9afc602384285401b252a1f57c12b54996b9b74bd45d8434d9b8ad5b764cddadd1938ce000f2842e27b733b59f93b8984384f0f9e0999371029b999e36
SSDEEP

6144:PLyto9KMLecTR/bsUpbm97VQ8873FKBkDORsnb6ZYvZNdHiVXj:PLKo9PLecFTsU9m9E73FSRsnb6wLIj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 4360	4640	rundll32.exe	87
PID 4640 wrote to memory of 4360	4640	rundll32.exe	87
PID 4640 wrote to memory of 4360	4640	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:4360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads