fa33a79cef198b9720dcd8c28a345e5532a6bc8c9b79db6640a2a5f6ad56ef82

Analysis

max time kernel
307s
max time network
1608s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16/05/2024, 09:59

Target

Bindu Software/Colorlab/XYDRV32.dll
Size

27KB
MD5

b4fd675fd9f9609b904425960274e5d9
SHA1

2b2c2c98ead208357531c6b1ac59c9c4b4a1986c
SHA256

0685564ca9590063541ec5d769baf6dd900068027f0ed54d306ba1cc0c29c457
SHA512

e562afc3cc14029c4698629f8cf7e3e3a06487918f94115f4a7fd3dbea0501ce92677c3176ea6ee317b73c09f500e33f3fbf401788f3429b2f36879e4092aec2
SSDEEP

384:UHEmC0Q45SIg0y2SS5dJcnsj7Uyp8IMstB2ZG6xLnOlzKqKeoJzO7sVn0eIXG:QEm34f2bJjYVsUZG6xaDroBj50bW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4452	4572	rundll32.exe	74
PID 4572 wrote to memory of 4452	4572	rundll32.exe	74
PID 4572 wrote to memory of 4452	4572	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Bindu Software\Colorlab\XYDRV32.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Bindu Software\Colorlab\XYDRV32.dll",#1
  2⤵
  PID:4452