159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

MicrosoftFixit20054/TS.ps1
Size

9KB
MD5

ae6ddc7e1f349321a731f64f1921448d
SHA1

32e6b2295951e6e3be4071289a7bce6be96e630e
SHA256

cc584a485f52d27750e01e0ff2592912f14d8f49d63b84d887a8408f9d3aab16
SHA512

bd43b9a7cd47b65e82254bd23b88909f92e234d2679182294b6b01fe1a94ee451605172e8887e6d9bbed88481e9793db5366a20e30fbaa4041829ca64771fdb7

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1316 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1316 powershell.exe

pid	process
1316	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1316	powershell.exe

memory/1316-0-0x000007FEF5CB0000-0x000007FEF669C000-memory.dmp

Filesize
9.9MB

Download
memory/1316-1-0x0000000001EC0000-0x0000000001EC1000-memory.dmp

Filesize
4KB

Download
memory/1316-2-0x000000001AE90000-0x000000001AE91000-memory.dmp

Filesize
4KB

Download
memory/1316-3-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/1316-4-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/1316-5-0x00000000029A0000-0x00000000029A1000-memory.dmp

Filesize
4KB

Download
memory/1316-6-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/1316-9-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/1316-21-0x00000000026B0000-0x00000000026B1000-memory.dmp

Filesize
4KB

Download
memory/1316-22-0x00000000026C0000-0x00000000026C1000-memory.dmp

Filesize
4KB

Download