b95c4f354f85a335502b63cbea99686ab2129897d7a81fa096a8ad80c6424eb4 | Triage

Analysis

max time kernel
98s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2022, 06:09

Sharing

Report Analysis Logs

General

Target

kmtwainlang.dll
Size

32KB
MD5

3729aa171f460f0583ab4ad2d0e975f6
SHA1

1fd96521afdcadd03c718042e698f2797542c07f
SHA256

c49a94d36ac24886f3535f9c38a3e2f4410b790aa8d3d92171d256aa564ebb80
SHA512

ba2f01a64a92934f250aaa4358a903e9e10139bff15ab71973773356cb665acadc47d28a6a9758992d729c029016d3da0bf0f0df9a77fa25b4b0f89724f04580
SSDEEP

192:eHXBKaUtzWlF50Fnn3kU688un8pnf7Ry4frYuVBoDJ0HBo:eRKFzWlF+VD688fnRYYoDJ5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 792	5012	regsvr32.exe	82
PID 5012 wrote to memory of 792	5012	regsvr32.exe	82
PID 5012 wrote to memory of 792	5012	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\kmtwainlang.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\kmtwainlang.dll
  2⤵
  PID:792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads