d7fb0cefe16760c341b4950f9c986e3297de4935e699a3c3be0cc98ca8e06026 | Triage

Analysis

max time kernel
144s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2022 06:09

Sharing

Report Analysis Logs

General

Target

kmtwainlang.dll
Size

32KB
MD5

7ba88dc576f5982fdd5b94c1c840ffcb
SHA1

238129eba872254720eab3864f7f5d91dde3d19f
SHA256

a05bb06fbebe1747a1f39b18efbff657154c77bb6e2893fe48cee3a4ae3d2eaa
SHA512

c36c9c8f7f13645869da06d20ab1c38a3a6ed7f2e6bc9c48cf9ed13c6e292ed4525edc70f11845d1d9aab16ffc62da1ee1086891d7740871fdde7965c99a41b7
SSDEEP

192:e8XBKaUtzWlF20EU688unAtQz/GzuhMhquBq3YuVsoDJ9ro:ewKFzWlFvT688wLG+YFoDJu

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 2284	364	regsvr32.exe	83
PID 364 wrote to memory of 2284	364	regsvr32.exe	83
PID 364 wrote to memory of 2284	364	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\kmtwainlang.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\kmtwainlang.dll
  2⤵
  PID:2284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2284-132-0x0000000000000000-mapping.dmp

Download