159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

MoreOption/Win8RC.RS.ps1
Size

10KB
MD5

dd7e1ff3fc2e754acc7e305088a2010a
SHA1

7b0aafe30d04eff716e4cbfde553cf912e7bfa3a
SHA256

4269454d14addd015af6fa3516c13518f0e59cedf6557c7009328a417ee61169
SHA512

e8bbb6674cb6cb30100709a7a7ce6cdcdd2149e74043b75a02f1e291d5791cd5f71be12654bb2be756cf39c119779106a22be00d71c12e5d79314d4026831e16

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

740 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 740 powershell.exe

pid	process
740	powershell.exe

description	pid	process
Token: SeDebugPrivilege	740	powershell.exe

memory/740-0-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download
memory/740-1-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/740-2-0x000000001AE30000-0x000000001AE31000-memory.dmp

Filesize
4KB

Download
memory/740-3-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/740-4-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/740-5-0x000000001B890000-0x000000001B891000-memory.dmp

Filesize
4KB

Download
memory/740-6-0x000000001B960000-0x000000001B961000-memory.dmp

Filesize
4KB

Download
memory/740-7-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/740-10-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/740-22-0x000000001ACE0000-0x000000001ACE1000-memory.dmp

Filesize
4KB

Download
memory/740-23-0x000000001ACF0000-0x000000001ACF1000-memory.dmp

Filesize
4KB

Download