b95c4f354f85a335502b63cbea99686ab2129897d7a81fa096a8ad80c6424eb4 | Triage

Analysis

max time kernel
137s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2022, 06:09

Sharing

Report Analysis Logs

General

Target

kmtwainlang.dll
Size

32KB
MD5

206cecf6c457a5abe0b6187b4af85bfc
SHA1

920bc111d00d7ab26984b1db47165b5be68f6de9
SHA256

4017daf10d41a08f57ff8119a2e8fb832a93408dd400aecd9c5c73befa00bd5a
SHA512

aab62a93da762b28936766a8bf3ca4e964be433912347d7281f783b9ea097395d71f854e5cb24106870e44fd2765cb03a1807d60a82418ad725301cbb417291d
SSDEEP

192:eRXBKaUtzWlFj0jU688unDzTq6E63bQl6EhSkiuSV9oDJlVGHo:ebKFzWlFgY688E7baSkiugoDJlVGI

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 1420	5036	regsvr32.exe	81
PID 5036 wrote to memory of 1420	5036	regsvr32.exe	81
PID 5036 wrote to memory of 1420	5036	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\kmtwainlang.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\kmtwainlang.dll
  2⤵
  PID:1420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads