159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

MoreOption/VF_Main.ps1
Size

10KB
MD5

83365ce0c2793462200fafa05c77a951
SHA1

b024d2beb1b3132c6a814d1f40d583b5b67a130a
SHA256

237043082f6f0a21886644dc18481f2bda29e2d8d016a2fd6d59dd7e1c25e98f
SHA512

2e772c7f58540491a0bd8d242d20a746d6c60385c4e582c693e7fcd8de65841939d2d65284245ffe6d44f3f3c8b9e941df00c7c35398cf2d285ca8816ae35195

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1144 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1144 powershell.exe

pid	process
1144	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1144	powershell.exe

memory/1144-0-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download
memory/1144-1-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/1144-2-0x000000001AB90000-0x000000001AB91000-memory.dmp

Filesize
4KB

Download
memory/1144-3-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/1144-4-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/1144-5-0x000000001B5C0000-0x000000001B5C1000-memory.dmp

Filesize
4KB

Download
memory/1144-6-0x000000001A860000-0x000000001A861000-memory.dmp

Filesize
4KB

Download
memory/1144-9-0x000000001AAD0000-0x000000001AAD1000-memory.dmp

Filesize
4KB

Download
memory/1144-21-0x00000000027D0000-0x00000000027D1000-memory.dmp

Filesize
4KB

Download
memory/1144-22-0x000000001B690000-0x000000001B691000-memory.dmp

Filesize
4KB

Download