fa33a79cef198b9720dcd8c28a345e5532a6bc8c9b79db6640a2a5f6ad56ef82

Analysis

max time kernel
374s
max time network
1596s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16/05/2024, 09:59

Target

Bindu Software/Colorlab/comms.dll
Size

48KB
MD5

fe75d7fa6d1de9b9397a78e9cd19bce9
SHA1

8a231f0d2c59316dbaaa2e5d2796892ea39957fc
SHA256

14e72449848a2129aaf02d425a358fcc142e9a5737d5b62f6d483035e494e27b
SHA512

f2293459edb2bb94ec320d93615c78709fe3abeb959c9b5a25b5e013e61db5971d4eafc8f55301184fd7c48eb417f2cf52f39e04831a61e50f2d07aadda597a8
SSDEEP

768:bEUF33hpWQwTxOl5nNe3kgMW7UvUjkAhCNetCdXSozBSJ2:oKWQwTxk5nNe3kgMKUcmrkozBSJ2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4592	5036	rundll32.exe	74
PID 5036 wrote to memory of 4592	5036	rundll32.exe	74
PID 5036 wrote to memory of 4592	5036	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Bindu Software\Colorlab\comms.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Bindu Software\Colorlab\comms.dll",#1
  2⤵
  PID:4592