159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

RS_NoOffice.ps1
Size

15KB
MD5

305a5774548127cb880d2a4f77283cbf
SHA1

70432bd4090c138560a235f9858fb28546bf8644
SHA256

2ecd95213b1f99623548c090ececa5acab17223f62d03874588bede562a86781
SHA512

885bf2d49ca51952b05b5f7a0dcd928bab00a76ebf5c00457bd9428ae8865c41b20f62b4ec909d1a23cad63f77c7d6c186ef40b699aeb68b349fa2731092bb02

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1420 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1420 powershell.exe

pid	process
1420	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1420	powershell.exe

memory/1420-0-0x000007FEF68F0000-0x000007FEF72DC000-memory.dmp

Filesize
9.9MB

Download
memory/1420-1-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/1420-2-0x000000001AE90000-0x000000001AE91000-memory.dmp

Filesize
4KB

Download
memory/1420-3-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download
memory/1420-4-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

Filesize
4KB

Download
memory/1420-5-0x000000001B8E0000-0x000000001B8E1000-memory.dmp

Filesize
4KB

Download
memory/1420-6-0x000000001B9B0000-0x000000001B9B1000-memory.dmp

Filesize
4KB

Download
memory/1420-7-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1420-10-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/1420-22-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download
memory/1420-23-0x00000000028B0000-0x00000000028B1000-memory.dmp

Filesize
4KB

Download