9eedec7a4c14e97094097b333883a2c27de961be541a63bcd1a080cb702ae40b

Analysis

max time kernel
39s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08/09/2022, 05:32

Target

(2040 2135 2635 2540 2235)kmtwainlang.dll
Size

32KB
MD5

fe0ac1843dae86f3ba5decd275302e59
SHA1

448691b51ec089dea03596e87cb7f0ac1304e87b
SHA256

0b4b4e6eb1f1176d67c8deda8b12a540de7f5332c6d8e695fbdbb311d37d2dc4
SHA512

80f5e95f05910d6d636ed6ea093abc543524fd4b3e6801c78ddf49541dda13857e02c4e74a11a1554e2f3a66c7d23354fda76b73e0a0f1f855ba3dc721efd4df
SSDEEP

192:UXBKaUtzWlFP0FnnbU688uneHP4UtHP4U9gYuVBoDJ0HBo:IKFzWlFcVg688I9kgYYoDJ5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 1136	1140	regsvr32.exe	27
PID 1140 wrote to memory of 1136	1140	regsvr32.exe	27
PID 1140 wrote to memory of 1136	1140	regsvr32.exe	27
PID 1140 wrote to memory of 1136	1140	regsvr32.exe	27
PID 1140 wrote to memory of 1136	1140	regsvr32.exe	27
PID 1140 wrote to memory of 1136	1140	regsvr32.exe	27
PID 1140 wrote to memory of 1136	1140	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\(2040 2135 2635 2540 2235)kmtwainlang.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\(2040 2135 2635 2540 2235)kmtwainlang.dll"
  2⤵
  PID:1136

memory/1136-56-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1140-54-0x000007FEFB871000-0x000007FEFB873000-memory.dmp

Filesize
8KB

Download