159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

MicrosoftFixit20052/Win8RC.VF.ps1
Size

10KB
MD5

c5fd8b8fd6440a26ece3ef8c76c3e040
SHA1

2b35cc8622e052da3be5fd54b82274ae56e8fa79
SHA256

a8b263d33c6c39d45db6175820e470d1728dcc8cbd0b05f019f067c77d9d5d05
SHA512

787f6c2bb9cdcf96b38f86ba8c56645d511a9d282a65abbdc3f0da776c73087b9b5f4a0c2f709bb7af995b9af6c46b8d5f9bb4be7927cf9582048ce4a6028aa7

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

880 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 880 powershell.exe

pid	process
880	powershell.exe

description	pid	process
Token: SeDebugPrivilege	880	powershell.exe

memory/880-0-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/880-1-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/880-2-0x000000001ACB0000-0x000000001ACB1000-memory.dmp

Filesize
4KB

Download
memory/880-3-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/880-4-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/880-5-0x000000001B730000-0x000000001B731000-memory.dmp

Filesize
4KB

Download
memory/880-6-0x000000001AB90000-0x000000001AB91000-memory.dmp

Filesize
4KB

Download
memory/880-7-0x000000001B680000-0x000000001B681000-memory.dmp

Filesize
4KB

Download
memory/880-10-0x000000001B800000-0x000000001B801000-memory.dmp

Filesize
4KB

Download
memory/880-22-0x000000001AC20000-0x000000001AC21000-memory.dmp

Filesize
4KB

Download
memory/880-23-0x000000001B8C0000-0x000000001B8C1000-memory.dmp

Filesize
4KB

Download