159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

MoreOption/VF_Main.ps1
Size

10KB
MD5

4fbb601e3c3dfc02085fa3a95b51e34f
SHA1

5a4d82dd0db2ca4f2271a21b9be3360e4384b5e2
SHA256

10c843d00f93565e32b132408ec22ea3f72ac369d23242ed3c1f546300602f97
SHA512

66e38bc8527f20bf943fc24192c7771980e7f35129b0305a589e08164123d69db3ca7fa65fe7b4c11dbaceecae3421288b140dcba8d9db5e958b1c68680d8e24

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1396 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1396 powershell.exe

pid	process
1396	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1396	powershell.exe

memory/1396-0-0x000007FEF6950000-0x000007FEF733C000-memory.dmp

Filesize
9.9MB

Download
memory/1396-1-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/1396-2-0x000000001AC10000-0x000000001AC11000-memory.dmp

Filesize
4KB

Download
memory/1396-3-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/1396-4-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/1396-5-0x000000001B5E0000-0x000000001B5E1000-memory.dmp

Filesize
4KB

Download
memory/1396-6-0x000000001A920000-0x000000001A921000-memory.dmp

Filesize
4KB

Download
memory/1396-9-0x000000001B500000-0x000000001B501000-memory.dmp

Filesize
4KB

Download
memory/1396-21-0x000000001B680000-0x000000001B681000-memory.dmp

Filesize
4KB

Download
memory/1396-22-0x000000001B690000-0x000000001B691000-memory.dmp

Filesize
4KB

Download