b95c4f354f85a335502b63cbea99686ab2129897d7a81fa096a8ad80c6424eb4 | Triage

Analysis

max time kernel
40s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
08/09/2022, 06:09

Sharing

Report Analysis Logs

General

Target

kmtwainlang.dll
Size

32KB
MD5

206cecf6c457a5abe0b6187b4af85bfc
SHA1

920bc111d00d7ab26984b1db47165b5be68f6de9
SHA256

4017daf10d41a08f57ff8119a2e8fb832a93408dd400aecd9c5c73befa00bd5a
SHA512

aab62a93da762b28936766a8bf3ca4e964be433912347d7281f783b9ea097395d71f854e5cb24106870e44fd2765cb03a1807d60a82418ad725301cbb417291d
SSDEEP

192:eRXBKaUtzWlFj0jU688unDzTq6E63bQl6EhSkiuSV9oDJlVGHo:ebKFzWlFgY688E7baSkiugoDJlVGI

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1216	1696	regsvr32.exe	27
PID 1696 wrote to memory of 1216	1696	regsvr32.exe	27
PID 1696 wrote to memory of 1216	1696	regsvr32.exe	27
PID 1696 wrote to memory of 1216	1696	regsvr32.exe	27
PID 1696 wrote to memory of 1216	1696	regsvr32.exe	27
PID 1696 wrote to memory of 1216	1696	regsvr32.exe	27
PID 1696 wrote to memory of 1216	1696	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\kmtwainlang.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\kmtwainlang.dll
  2⤵
  PID:1216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-56-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1696-54-0x000007FEFB641000-0x000007FEFB643000-memory.dmp

Filesize
8KB

Download