fa33a79cef198b9720dcd8c28a345e5532a6bc8c9b79db6640a2a5f6ad56ef82

Analysis

max time kernel
372s
max time network
1591s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16/05/2024, 09:59

Target

Bindu Software/Colorlab/haspdev.dll
Size

68KB
MD5

0e4092816a2e9af89aa97fed6515f4c1
SHA1

4f0d0f71ea6e5fa56e190aac86f90ec12a9434f0
SHA256

8a25a1ea30307b520102fb57e67685cb7130921ef0bffdba2e94fe6052b80175
SHA512

ec6829ade685ff760a053d2e3c3cfb081df3d7d586af02f5c103a39845a7cf4a4bb642c10fcb98515b0a6c7e52e1830221db547f8a44d36d37818a9b937bd0bf
SSDEEP

768:SYzpcNhHcmhVoyRwjTtTtqyxPnORSNx1K8MJglVOwPYiOoo+qo83:SYzW7GjTtT3JnORSNxr5Uoo+qo83

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 3500	220	rundll32.exe	75
PID 220 wrote to memory of 3500	220	rundll32.exe	75
PID 220 wrote to memory of 3500	220	rundll32.exe	75

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Bindu Software\Colorlab\haspdev.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Bindu Software\Colorlab\haspdev.dll",#1
  2⤵
  PID:3500