9eedec7a4c14e97094097b333883a2c27de961be541a63bcd1a080cb702ae40b

Analysis

max time kernel
119s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2022 05:32

Target

(2040 2135 2635 2540 2235)kmtwainlang.dll
Size

32KB
MD5

eaa84219d1c0f42cf7abe951d566868d
SHA1

c17a8e5f611e269ec9d38db04bf8cc6f98f0337e
SHA256

b9627ee443dbd4b32090fdd44b8c8296e500fb5e1498b276a4f1bd4e6241bcf6
SHA512

6e046c3f7876989f52a125aea1c796dc24da62f474a762d229fea92c1114ff6365ed1eef44b7302903381dc72cfcb4250db83636459fbc38ac16880bedc87b3d
SSDEEP

192:0XBKaUtzWlFn0yU688unS677iebxUMUiebxUMS7CYuVBoDJno:oKFzWlF0N688wb4bS7CYIoDJo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1876	4972	regsvr32.exe	82
PID 4972 wrote to memory of 1876	4972	regsvr32.exe	82
PID 4972 wrote to memory of 1876	4972	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\(2040 2135 2635 2540 2235)kmtwainlang.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\(2040 2135 2635 2540 2235)kmtwainlang.dll"
  2⤵
  PID:1876