159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

TS_Main.ps1
Size

13KB
MD5

055cf77e11385aa07034889a29c6612b
SHA1

2b285e7bacaa3492c84d7fdcbd31340476e3fd09
SHA256

45d7d4d5554c40b99a4363ad486c33aa0f53b5296b089cb601c66103d09da5b1
SHA512

564ffde30a0f5ab82094747c3c2f1ec892c4af5b941eeed1bb3df0e85e4cb43f53c8a00d08e76416520518c597c1f0cf69b90dccc59a968a0849f9263bdabeff

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

604 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 604 powershell.exe

pid	process
604	powershell.exe

description	pid	process
Token: SeDebugPrivilege	604	powershell.exe

memory/604-0-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

Filesize
9.9MB

Download
memory/604-1-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/604-2-0x000000001AB20000-0x000000001AB21000-memory.dmp

Filesize
4KB

Download
memory/604-3-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/604-4-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/604-5-0x000000001C580000-0x000000001C581000-memory.dmp

Filesize
4KB

Download
memory/604-6-0x000000001B3D0000-0x000000001B3D1000-memory.dmp

Filesize
4KB

Download
memory/604-9-0x000000001B580000-0x000000001B581000-memory.dmp

Filesize
4KB

Download
memory/604-21-0x000000001B660000-0x000000001B661000-memory.dmp

Filesize
4KB

Download
memory/604-22-0x000000001B670000-0x000000001B671000-memory.dmp

Filesize
4KB

Download
memory/604-23-0x000000001B770000-0x000000001B771000-memory.dmp

Filesize
4KB

Download