fa33a79cef198b9720dcd8c28a345e5532a6bc8c9b79db6640a2a5f6ad56ef82

Analysis

max time kernel
311s
max time network
1584s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16/05/2024, 09:59

Target

Bindu Software/Colorlab/x2d200.dll
Size

228KB
MD5

99c4cce433ac241508cea43870b74788
SHA1

e1d5d6ee0bd142c443cc25461158a1855bf8824a
SHA256

ad0e6509203d8e9b01bca9408f6b98726230a35ca57c6c3e57d3570fe12e3359
SHA512

a342bad3f31b6c91ba0fabd9226e4b4b03928798dbde35b3cc530f8031c676c3b283a6064f38f7c2176c0f2e854fd08f1450017720e9fa3a1618b7f0ab7575f1
SSDEEP

3072:6vFG4T7Put2pABhvXSrpQ8ETDkt5XOjo9jEkwLaZOZBL+8Kio/Dbug9nnn5Lh:9EPfuXRTDkt59S5Lyug9th

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 4332	2116	rundll32.exe	73
PID 2116 wrote to memory of 4332	2116	rundll32.exe	73
PID 2116 wrote to memory of 4332	2116	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Bindu Software\Colorlab\x2d200.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Bindu Software\Colorlab\x2d200.dll",#1
  2⤵
  PID:4332