CmdID / Files

WmiApRpl.dll

WMI Performance Reverse Adapter file version info

Library on Windows 2 known copies with hashes 1 Sigma rule names it

Is it the real WmiApRpl.dll?

file version info and known copies

Installed inC:\Windows\system32\wbem\
C:\Windows\SysWOW64\wbem\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWMI Performance Reverse Adapter

2 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wbem\WmiApRpl.dll · signed by Microsoft Windows

SHA-2567d681adc24813188e0c6a005aad5bb046b93214b1451083a86634dc40c3fd3e6SHA-1a88b247840cfc36755c49ecc3b7be17c987d8af2MD56ad0ceecbe1c4ddde0d88a848e54f4a8

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WmiApRpl.dll · signed by Microsoft Windows

SHA-256b4c8927c2e7c8dd89470c3601b66c38d1ef6c91aa5c56ddbff6322d22278a9a9SHA-1e55abd90557482c2fa342ff94d1c7fbda71ae5fcMD59494286bead4a0a3282b74dac24745ec

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<hash>".whatis() says which known copy an MD5, SHA-1 or SHA-256 is.

What detects it

Sigma rules that name WmiApRpl.dll

When it is loaded

lowWMI Module Loaded By Uncommon ProcessRoberto Rodriguez @Cyb3rWard0g

CmdID evaluates Sigma’s process creation rules against a command line. These watch what a command line does not show: a library or a driver loading, a file written, the registry, another process opened, event logs. They are listed as Sigma has them, at SigmaHQ.