6c517c953ffb309da51b242412dd2328391644f131c0177f2944168477dfefc2 | Triage

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 11:59

Sharing

Report Analysis Logs

General

Target

WsmAgent.dll
Size

22KB
MD5

8ce07c343259bdb5c20e758fd0c7e5c3
SHA1

30aac8e1e6b8cdbabe700a4ff2f0b48afdbb1281
SHA256

6c517c953ffb309da51b242412dd2328391644f131c0177f2944168477dfefc2
SHA512

2f26cae65c81b7bf9198e431c51e1a31844ef2ee5ce30b4e90c06b1a665482032a35f4815eeb12993372d4df6fa3ba33882d1f5724761498b653bcbc219cd404
SSDEEP

384:79tYoRh7SrcIvtLxClRk87qd6AtB6zge5WEa0z0tEWshW0EP/:BtxRM/ClN5Ot64/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 1848	444	regsvr32.exe	82
PID 444 wrote to memory of 1848	444	regsvr32.exe	82
PID 444 wrote to memory of 1848	444	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\WsmAgent.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:444
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\WsmAgent.dll
  2⤵
  PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads