fa33a79cef198b9720dcd8c28a345e5532a6bc8c9b79db6640a2a5f6ad56ef82

Analysis

max time kernel
311s
max time network
1607s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16/05/2024, 09:59

Target

Bindu Software/Colorlab/haspds_windows.dll
Size

8.4MB
MD5

d41928463aad24d826d9f87deac6277f
SHA1

0d6dce2c3ce0d747c4b0b522a71ebdc65786ea1e
SHA256

8dcb3932fffac482c56550a92e659ce2efd51ea71df66d7afe5bcdae6e84176e
SHA512

b81772a30694985dd4d322724a4209c4543abd9a9c005b2c75b60b3cb85e9b4be5b58d34de3b405189c64a3a39624038332938372d5c1d1772ea38b934263e3b
SSDEEP

196608:AZQJ6xs/f5fU0GEDSHv9kGPMIOmmCSTbLQsOfmh1ilWIQ:AeoxeQTHlkGPwhCSTD+o

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 68	3068	rundll32.exe	74
PID 3068 wrote to memory of 68	3068	rundll32.exe	74
PID 3068 wrote to memory of 68	3068	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Bindu Software\Colorlab\haspds_windows.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Bindu Software\Colorlab\haspds_windows.dll",#1
  2⤵
  PID:68