9eedec7a4c14e97094097b333883a2c27de961be541a63bcd1a080cb702ae40b

Analysis

max time kernel
116s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2022, 05:32

Target

(2040 2135 2635 2540 2235)kmtwainlang.dll
Size

32KB
MD5

de9b9185b573e2565d8df7305001cbb3
SHA1

a6a53b251d10bd34f92f79f13791cb310e8f6989
SHA256

48534abc0dade4e52127342a2a4c55a08ce1b401af02c83fa90196a5b708a06a
SHA512

62c4872366d921cd0dc30c0368cb1de3b6c45b474d5b075c2cdd961c3c090e1e9e3d3a90d004ad039a9a11c058d1485e8aef72979695ee4ce6e9c105caa9728e
SSDEEP

192:4XBKaUtzWlFv0KU688un+43wJ4JNUe4JNUMaIYuVDoDJIo:MKFzWlF81688UA1aIYmoDJH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 3688	828	regsvr32.exe	84
PID 828 wrote to memory of 3688	828	regsvr32.exe	84
PID 828 wrote to memory of 3688	828	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\(2040 2135 2635 2540 2235)kmtwainlang.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\(2040 2135 2635 2540 2235)kmtwainlang.dll"
  2⤵
  PID:3688