527c776c2718e4e9be884d2b79c5a79a5cebf1512d04785c5949862c4bae7253 | Triage™

Analysis

max time kernel
109s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 17:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wps_0000000001AA0000.dll
Size 208KB
Sample220720-wj74kaecdj
SHA256 527c776c2718e4e9be884d2b79c5a79a5cebf1512d04785c5949862c4bae7253
MD5 6c59df4af7127f69cfee1aba17cae985
SHA1 4ee6b1c68189e25d8c47ced7d0cbb29db484905a
SHA512 ec12a1b7ad44cfe3d135fbc3ee6b782d911f155481e6dab974e94a2246302af1d413b9d507df7e58e5c6e4d3e8bcc98eba8266fe7fbd71ad82a575df57e57fa0
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2400	rundll32.exe
Token: SeTcbPrivilege	2400	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wps_0000000001AA0000.dll,#1
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads