b95c4f354f85a335502b63cbea99686ab2129897d7a81fa096a8ad80c6424eb4 | Triage

Analysis

max time kernel
131s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2022, 06:09

Sharing

Report Analysis Logs

General

Target

kmtwainlang.dll
Size

32KB
MD5

e294ae5e780dbc64bd74b339b5d8377f
SHA1

84faae9627a0cf6520fb8dcccb36e3dd87c45b2d
SHA256

50354774438f47c5aedc8ebe24d4cda463c7010c6fb89dbde7ce51dc31324d6d
SHA512

429ade6565307cc278dbfed72c4e72040220de0d4576ee280528c040c13ec2c40ab0caf25358a71c8173bbcd385a26ecb121ecce6837ec0c2311ae21077b741c
SSDEEP

192:e+XBKaUtzWlFQ0UU688unPg9SKTPT6SR6uSV+oDJplrb7o:e6KFzWlFhj688s4P/6ufoDJpW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 4156	4792	regsvr32.exe	84
PID 4792 wrote to memory of 4156	4792	regsvr32.exe	84
PID 4792 wrote to memory of 4156	4792	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\kmtwainlang.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\kmtwainlang.dll
  2⤵
  PID:4156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads