b95c4f354f85a335502b63cbea99686ab2129897d7a81fa096a8ad80c6424eb4 | Triage

Analysis

max time kernel
39s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08/09/2022, 06:09

Sharing

Report Analysis Logs

General

Target

kmtwainlang.dll
Size

32KB
MD5

fc71ef5ad820099755efb6318a9696db
SHA1

2c15f29b5db0384792d474539a2dbd0eea886a6f
SHA256

bd1edaafecc3c63a956e806881e0177ee906a6245563e8f3893f70d54b8db3ee
SHA512

4b6dbc57ea0111e6043166b30dba9c62ad5fe05e418aed1093a6f2399efe835510d43ae86f56ef55736f5a2019b4d9de186d4f202c96dfadcd0fe1f5a9e12212
SSDEEP

192:eKXBKaUtzWlFw0g3U688un+43wB9xNXbG2N7IYuVDoDJIo:eGKFzWlFBgk688jZRIYmoDJH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 1144	1012	regsvr32.exe	28
PID 1012 wrote to memory of 1144	1012	regsvr32.exe	28
PID 1012 wrote to memory of 1144	1012	regsvr32.exe	28
PID 1012 wrote to memory of 1144	1012	regsvr32.exe	28
PID 1012 wrote to memory of 1144	1012	regsvr32.exe	28
PID 1012 wrote to memory of 1144	1012	regsvr32.exe	28
PID 1012 wrote to memory of 1144	1012	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\kmtwainlang.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\kmtwainlang.dll
  2⤵
  PID:1144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1012-54-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Filesize
8KB

Download
memory/1144-56-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download