fa33a79cef198b9720dcd8c28a345e5532a6bc8c9b79db6640a2a5f6ad56ef82

Analysis

max time kernel
311s
max time network
1608s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16/05/2024, 09:59

Target

Bindu Software/Colorlab/msxml2.dll
Size

685KB
MD5

603b075af359f7512c1e3cd2004f6ee3
SHA1

bd2924af251a7195d918dad0e6edba6c1a0ec83a
SHA256

7d69f71d2d8756cc17ab0949d0c661718f5c3d4ae1959a42448e4c0938da1b8b
SHA512

43bcf39ae360e4645659cb9b6760407be3caa300294e9a6bcfc0b71c510e0417a4a25cb3173fb42cef9d186b6d60cd118e2e3fa4a45b5725ee6c757ac59d792c
SSDEEP

12288:2ytbvWA7s0hIJlnAEQ0p1WwboGgnf1qgTsc98YYnC/TSjps2AJ9i:nbuA7sJ5DEFf0eX8X0gpJAL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1280	2336	regsvr32.exe	74
PID 2336 wrote to memory of 1280	2336	regsvr32.exe	74
PID 2336 wrote to memory of 1280	2336	regsvr32.exe	74

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Bindu Software\Colorlab\msxml2.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\Bindu Software\Colorlab\msxml2.dll"
  2⤵
  PID:1280