159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

MicrosoftFixit20052/VR.ps1
Size

9KB
MD5

0ac8452f2dc49fc5eefbe30bb41466a9
SHA1

fe8854a53fe01cfccefcf9c6136ac670e2bee9dd
SHA256

1190ad9fea590bd47adb4de07337338de5d29bb9d642338d98a625a1fd5b0dfd
SHA512

8dfe9e9d4592e9afba54f38350a5f133278751c3f72cb37eed23142cc262eb8d42d2e69b3abd705ac05134952ce4b772f73c3734401c9a9265874bc3f228df8b

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1044 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1044 powershell.exe

pid	process
1044	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1044	powershell.exe

memory/1044-0-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp

Filesize
9.9MB

Download
memory/1044-1-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/1044-2-0x000000001AA30000-0x000000001AA31000-memory.dmp

Filesize
4KB

Download
memory/1044-3-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/1044-4-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/1044-5-0x000000001B8B0000-0x000000001B8B1000-memory.dmp

Filesize
4KB

Download
memory/1044-6-0x000000001A8C0000-0x000000001A8C1000-memory.dmp

Filesize
4KB

Download
memory/1044-9-0x000000001B410000-0x000000001B411000-memory.dmp

Filesize
4KB

Download
memory/1044-21-0x000000001A990000-0x000000001A991000-memory.dmp

Filesize
4KB

Download
memory/1044-22-0x000000001A9A0000-0x000000001A9A1000-memory.dmp

Filesize
4KB

Download