b95c4f354f85a335502b63cbea99686ab2129897d7a81fa096a8ad80c6424eb4

Analysis

max time kernel
146s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2022, 06:09

Target

(2040 2135 2635 2540 2235)kmtwainlang.dll
Size

32KB
MD5

1844136c01f2c616f858d9f022eb0ad4
SHA1

deb79f81b47fd2be35ea81cf68ec1a8961a24c8d
SHA256

a23fadb3a1f9fa46550ecfb773c7a87b2dbc89ba8072d35131ab491a528d7764
SHA512

9b982e3cf88d7058fca5a9a4c56b40bf401aa564afa2cab13b80f70b52ccde6a53ae279024bdfdb0dbacf3b6e57f9c7dc79ca5140384b0956efdf26828fb9648
SSDEEP

192:nXBKaUtzWlFw0IU688unx+5cKwUi+5cKwUJRuSVDoDJ+Fk1Qo:xKFzWlFB/688iPURuqoDJ++

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2284	1780	regsvr32.exe	82
PID 1780 wrote to memory of 2284	1780	regsvr32.exe	82
PID 1780 wrote to memory of 2284	1780	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\(2040 2135 2635 2540 2235)kmtwainlang.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\(2040 2135 2635 2540 2235)kmtwainlang.dll"
  2⤵
  PID:2284