159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

MicrosoftFixit20052/Win8RC.RS.ps1
Size

10KB
MD5

70a89084aa675691b3759c85d6197164
SHA1

8ebcd534fe9f0950b48d268a3aba364e86b9721f
SHA256

65bc24a1ec233d19166cf089410b6b18091287a799909b45343ae8c4e0c28879
SHA512

64df5760a8ecb5b57ed8e0b14c45339bb1671d1c570753b7c045382fa9fa90a400d1a2a15d7079f30b8acec226aef946ca14e3698626ed6bfb395d105ab16d84

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

604 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 604 powershell.exe

pid	process
604	powershell.exe

description	pid	process
Token: SeDebugPrivilege	604	powershell.exe

memory/604-0-0x000007FEF5D70000-0x000007FEF675C000-memory.dmp

Filesize
9.9MB

Download
memory/604-1-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/604-2-0x000000001AC20000-0x000000001AC21000-memory.dmp

Filesize
4KB

Download
memory/604-3-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/604-4-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/604-5-0x000000001B590000-0x000000001B591000-memory.dmp

Filesize
4KB

Download
memory/604-6-0x000000001C4D0000-0x000000001C4D1000-memory.dmp

Filesize
4KB

Download
memory/604-7-0x000000001BA90000-0x000000001BA91000-memory.dmp

Filesize
4KB

Download
memory/604-10-0x000000001C560000-0x000000001C561000-memory.dmp

Filesize
4KB

Download
memory/604-22-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download
memory/604-23-0x0000000002A00000-0x0000000002A01000-memory.dmp

Filesize
4KB

Download