b95c4f354f85a335502b63cbea99686ab2129897d7a81fa096a8ad80c6424eb4

Analysis

max time kernel
45s
max time network
51s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08/09/2022, 06:09

Target

(2040 2135 2635 2540 2235)kmtwainlang.dll
Size

32KB
MD5

fe0ac1843dae86f3ba5decd275302e59
SHA1

448691b51ec089dea03596e87cb7f0ac1304e87b
SHA256

0b4b4e6eb1f1176d67c8deda8b12a540de7f5332c6d8e695fbdbb311d37d2dc4
SHA512

80f5e95f05910d6d636ed6ea093abc543524fd4b3e6801c78ddf49541dda13857e02c4e74a11a1554e2f3a66c7d23354fda76b73e0a0f1f855ba3dc721efd4df
SSDEEP

192:UXBKaUtzWlFP0FnnbU688uneHP4UtHP4U9gYuVBoDJ0HBo:IKFzWlFcVg688I9kgYYoDJ5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 880	756	regsvr32.exe	28
PID 756 wrote to memory of 880	756	regsvr32.exe	28
PID 756 wrote to memory of 880	756	regsvr32.exe	28
PID 756 wrote to memory of 880	756	regsvr32.exe	28
PID 756 wrote to memory of 880	756	regsvr32.exe	28
PID 756 wrote to memory of 880	756	regsvr32.exe	28
PID 756 wrote to memory of 880	756	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\(2040 2135 2635 2540 2235)kmtwainlang.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\(2040 2135 2635 2540 2235)kmtwainlang.dll"
  2⤵
  PID:880

memory/756-54-0x000007FEFC1B1000-0x000007FEFC1B3000-memory.dmp

Filesize
8KB

Download
memory/880-56-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download