fa33a79cef198b9720dcd8c28a345e5532a6bc8c9b79db6640a2a5f6ad56ef82

Analysis

max time kernel
312s
max time network
1587s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16/05/2024, 09:59

Target

Bindu Software/Colorlab/haspclnt.dll
Size

364KB
MD5

278e93e84efc7d8649a86af14cab5f78
SHA1

3248fd1e32e72aa42d291fac0f64e9b170f5116f
SHA256

3faacf887634047a919f7ecb42c933d47b9f84b749b286c4f015b4a82a105dae
SHA512

6e32647227721444527896dc403eabd230e419ab23100d0a30eee27e44a3eebbf875d6b34474dd6be46f1f46b1adb2a746441c84fdf907e97d7077b60107cabc
SSDEEP

6144:kdkl9FSWti60j8xdQU02r7uBCoWnjBHWtT/Bw5uB1KcRvMYq79pnc3EIGNsU:kO9FS9eHtHuCrWtT/t1Tq79a3EZNs

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4672	4392	rundll32.exe	74
PID 4392 wrote to memory of 4672	4392	rundll32.exe	74
PID 4392 wrote to memory of 4672	4392	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Bindu Software\Colorlab\haspclnt.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Bindu Software\Colorlab\haspclnt.dll",#1
  2⤵
  PID:4672

memory/4672-0-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download