527c776c2718e4e9be884d2b79c5a79a5cebf1512d04785c5949862c4bae7253 | Triage

Analysis

max time kernel
109s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 17:58

Sharing

Report Analysis Logs

General

Target

wps_0000000001AA0000.dll
Size

208KB
MD5

6c59df4af7127f69cfee1aba17cae985
SHA1

4ee6b1c68189e25d8c47ced7d0cbb29db484905a
SHA256

527c776c2718e4e9be884d2b79c5a79a5cebf1512d04785c5949862c4bae7253
SHA512

ec12a1b7ad44cfe3d135fbc3ee6b782d911f155481e6dab974e94a2246302af1d413b9d507df7e58e5c6e4d3e8bcc98eba8266fe7fbd71ad82a575df57e57fa0

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 2400 rundll32.exe
Token: SeTcbPrivilege 2400 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wps_0000000001AA0000.dll,#1
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...