159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

MicrosoftFixit20055/Win8RC.RS.ps1
Size

10KB
MD5

c3e005c64082a8e978bed121a828bea0
SHA1

94a3b4a66f31f484b54776f6ee5c11e2daea3f29
SHA256

0dba3226e530769d8fcde734bd4e429f6be3f14d6d351b449634ee38614b89c0
SHA512

550db1701825589e111dbce40b863c15655fdf165f3609419ef5ffd0f96d1f95edcd96944c2ea41f7119cab704ad73df09da2a67429b88bd0797d15c9e226a31

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1116 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1116 powershell.exe

pid	process
1116	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1116	powershell.exe

memory/1116-0-0x000007FEF6210000-0x000007FEF6BFC000-memory.dmp

Filesize
9.9MB

Download
memory/1116-1-0x0000000001E30000-0x0000000001E31000-memory.dmp

Filesize
4KB

Download
memory/1116-2-0x000000001AC80000-0x000000001AC81000-memory.dmp

Filesize
4KB

Download
memory/1116-3-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/1116-4-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/1116-5-0x000000001B900000-0x000000001B901000-memory.dmp

Filesize
4KB

Download
memory/1116-6-0x000000001C430000-0x000000001C431000-memory.dmp

Filesize
4KB

Download
memory/1116-7-0x00000000027F0000-0x00000000027F1000-memory.dmp

Filesize
4KB

Download
memory/1116-10-0x000000001AB90000-0x000000001AB91000-memory.dmp

Filesize
4KB

Download
memory/1116-22-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/1116-23-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download