b95c4f354f85a335502b63cbea99686ab2129897d7a81fa096a8ad80c6424eb4

Analysis

max time kernel
96s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2022, 06:09 UTC

Target

(2040 2135 2635 2540 2235)kmtwainlang.dll
Size

32KB
MD5

de9b9185b573e2565d8df7305001cbb3
SHA1

a6a53b251d10bd34f92f79f13791cb310e8f6989
SHA256

48534abc0dade4e52127342a2a4c55a08ce1b401af02c83fa90196a5b708a06a
SHA512

62c4872366d921cd0dc30c0368cb1de3b6c45b474d5b075c2cdd961c3c090e1e9e3d3a90d004ad039a9a11c058d1485e8aef72979695ee4ce6e9c105caa9728e
SSDEEP

192:4XBKaUtzWlFv0KU688un+43wJ4JNUe4JNUMaIYuVDoDJIo:MKFzWlF81688UA1aIYmoDJH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2344	1912	regsvr32.exe	82
PID 1912 wrote to memory of 2344	1912	regsvr32.exe	82
PID 1912 wrote to memory of 2344	1912	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\(2040 2135 2635 2540 2235)kmtwainlang.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\(2040 2135 2635 2540 2235)kmtwainlang.dll"
  2⤵
  PID:2344