colorcpl.exe

  • File Path: C:\WINDOWS\system32\colorcpl.exe
  • Description: Microsoft Color Control Panel

Screenshot

colorcpl.exe

Hashes

Type Hash
MD5 94B841F0F91E6388E22F6075821CCDC6
SHA1 640C0936796E6EF547B3102794072DE0D68437CD
SHA256 4DA82A191CCDEB14123557F07F499EA7A39BF9F31F53FEA096FA574DA8C6AD1B
SHA384 5ABDCD7626DA52AE2CD628CDAF326AF7F74619CA0BB0CD271A3A338002EC36022E5162694F13AC09FC39730082EAEF10
SHA512 D8F67C52AB38F82F96521E35DB3D5162D12962C223B5D594BF2B9663F1F2821A1923F0770DA17892355C83718FF065E60722CA773214C79E0098095217A9DF44
SSDEEP 1536:gSrr+IPfSbS9vMBN7rQOJ7CFToTCzhcRguhwxTyPCb3lZpdym4dy7p:gOJXlvq7jSP1cR2prbpdCY9
IMP BF699192BC903253BE75CBD63776138C
PESHA1 1F4BFA87D0D9963C82AA121095AC14C46BBFA73F
PE256 113323E48C269006AEE00E153B0378B116FA1D1E7EFDFD83CF01BD63A8E685BB

Runtime Data

Window Title:

Color Management

Open Handles:

Path Type
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\colorcpl.exe.mui File
(R-D) C:\Windows\System32\en-US\colorui.dll.mui File
(R-D) C:\Windows\System32\en-US\duser.dll.mui File
(R-D) C:\Windows\SystemResources\imageres.dll.mun File
(R-D) C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.22000.1_en-us_6b887e04d8b70b4e\comctl32.dll.mui File
(RW-) C:\Windows\System32 File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.22000.1_en-us_6b887e04d8b70b4e File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_9d947278b86cc467 File
\BaseNamedObjects__ComCatalogCache__ Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\2\Windows\Theme1077709572 Section
\Windows\Theme3461253685 Section

Loaded Modules:

Path
C:\WINDOWS\system32\colorcpl.exe
C:\WINDOWS\system32\colorui.dll
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\System32\msvcrt.dll
C:\WINDOWS\SYSTEM32\ntdll.dll

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: colorcpl.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/74
  • VirusTotal Link: https://www.virustotal.com/gui/file/4da82a191ccdeb14123557f07f499ea7a39bf9f31f53fea096fa574da8c6ad1b/detection

File Similarity (ssdeep match)

File Score
C:\windows\system32\colorcpl.exe 94
C:\WINDOWS\system32\colorcpl.exe 94
C:\Windows\system32\colorcpl.exe 94
C:\Windows\system32\colorcpl.exe 93
C:\Windows\system32\colorcpl.exe 94
C:\windows\SysWOW64\colorcpl.exe 93
C:\WINDOWS\SysWOW64\colorcpl.exe 96
C:\Windows\SysWOW64\colorcpl.exe 94
C:\Windows\SysWOW64\colorcpl.exe 94
C:\Windows\SysWOW64\colorcpl.exe 94
C:\WINDOWS\SysWOW64\colorcpl.exe 94

Possible Misuse

The following table contains possible examples of colorcpl.exe being misused. While colorcpl.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma file_event_win_susp_colorcpl.yml title: Suspicious Creation with Colorcpl DRL 1.0
sigma file_event_win_susp_colorcpl.yml description: Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\ DRL 1.0
sigma file_event_win_susp_colorcpl.yml Image\|endswith: \colorcpl.exe DRL 1.0

MIT License. Copyright (c) 2020-2021 Strontic.