159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

RS_SingleOffice.ps1
Size

17KB
MD5

058b4e6d155b68917285abf2cdd48e9a
SHA1

c4a72a79fcac8e72f6b23fe06d8438df764b2f95
SHA256

c7def9d8e561d40171909034e23eaf8e8849184d45379a7d2e26d470b5fc7ac0
SHA512

e3b0ceee090e46255da4087ecae7e6db31b2cfdc11c36322bce4a6d1ac0df7516d4992b33f15d66afbc9540189a9b7624b28c455619f02c5020fc1245a8131bd

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

824 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 824 powershell.exe

pid	process
824	powershell.exe

description	pid	process
Token: SeDebugPrivilege	824	powershell.exe

memory/824-0-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/824-1-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/824-2-0x000000001ABD0000-0x000000001ABD1000-memory.dmp

Filesize
4KB

Download
memory/824-3-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/824-4-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/824-5-0x000000001C4C0000-0x000000001C4C1000-memory.dmp

Filesize
4KB

Download
memory/824-6-0x000000001C7A0000-0x000000001C7A1000-memory.dmp

Filesize
4KB

Download
memory/824-7-0x000000001AB10000-0x000000001AB11000-memory.dmp

Filesize
4KB

Download
memory/824-10-0x000000001B6C0000-0x000000001B6C1000-memory.dmp

Filesize
4KB

Download
memory/824-22-0x0000000002870000-0x0000000002871000-memory.dmp

Filesize
4KB

Download
memory/824-23-0x000000001AB40000-0x000000001AB41000-memory.dmp

Filesize
4KB

Download