159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

RS_MultipleOffice.ps1
Size

20KB
MD5

7f0d56d3e0bdefbe11f82f02ef178bac
SHA1

d7459e5f612062d5e48ac68bdf021713df59b03c
SHA256

e4e293871e7bfa87730dc6103b43b8776ceebcfcd8419fcbac5cee0d2c0f1857
SHA512

8816121a4ac5047f3ca0785d20759cab4d4bd74cd8dcb64a9768c2ca52b803c36bd7eda1fd45c43fc76a8b27d0bde8088e690626549a4325897579d628a5ca68

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

992 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 992 powershell.exe

pid	process
992	powershell.exe

description	pid	process
Token: SeDebugPrivilege	992	powershell.exe

memory/992-0-0x000007FEF6AE0000-0x000007FEF74CC000-memory.dmp

Filesize
9.9MB

Download
memory/992-1-0x0000000002060000-0x0000000002061000-memory.dmp

Filesize
4KB

Download
memory/992-2-0x000000001AA70000-0x000000001AA71000-memory.dmp

Filesize
4KB

Download
memory/992-3-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/992-4-0x0000000002120000-0x0000000002121000-memory.dmp

Filesize
4KB

Download
memory/992-5-0x000000001C4C0000-0x000000001C4C1000-memory.dmp

Filesize
4KB

Download
memory/992-6-0x000000001B790000-0x000000001B791000-memory.dmp

Filesize
4KB

Download
memory/992-7-0x0000000002770000-0x0000000002771000-memory.dmp

Filesize
4KB

Download
memory/992-10-0x000000001A8B0000-0x000000001A8B1000-memory.dmp

Filesize
4KB

Download
memory/992-22-0x000000001B5E0000-0x000000001B5E1000-memory.dmp

Filesize
4KB

Download
memory/992-23-0x000000001B5F0000-0x000000001B5F1000-memory.dmp

Filesize
4KB

Download