48e724306f80ce994f53f49c5c8274d75cc59d98f051a9d8301977002b1c12c8 | Triage

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:37

Sharing

Report Analysis Logs

General

Target

bindevt.dll
Size

448KB
MD5

f46227634a0e8e28817d6b822ab1a556
SHA1

498da6af461668d13e4a6446b08c0d8f9a6258ac
SHA256

94c750cd6f7a8836ac8df094bbbfc6abac7078deb68aede94cff12b900d46966
SHA512

03d65457506b2391981e6fa38c89a590847464fccf1339320de4fb9697815f8720748a457b54f7c0bd1a6ccf7241e8770442cd2fde2b4d8041f8f7596435905f
SSDEEP

6144:8Lyto9KMLecTR/bsUpbm97VQ8873FKBkDORsnb6ZYENedHiVXj:8LKo9PLecFTsU9m9E73FSRsnb67AIj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2220	2116	rundll32.exe	28
PID 2116 wrote to memory of 2220	2116	rundll32.exe	28
PID 2116 wrote to memory of 2220	2116	rundll32.exe	28
PID 2116 wrote to memory of 2220	2116	rundll32.exe	28
PID 2116 wrote to memory of 2220	2116	rundll32.exe	28
PID 2116 wrote to memory of 2220	2116	rundll32.exe	28
PID 2116 wrote to memory of 2220	2116	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bindevt.dll,#1
  2⤵
  PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads