159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

VF_MultipleOffice.ps1
Size

12KB
MD5

3c6e8654e7939f5e778c0f9d57ea9511
SHA1

fd04d98953558f7933ef724a8b5f04a98c5f8296
SHA256

08fd3aed44d37c76f157218e5b0845fc17871fedb91c8d1dc46acebcdf7a2a72
SHA512

7755dc869c36299dcb7a25074a9df18749eefed12baac33e5232a9d5cd726bd957ccf85d389621c11ae42e9707aba0c8e2a14535ba7c43f41e58b119b1b6f327

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1060 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1060 powershell.exe

pid	process
1060	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1060	powershell.exe

memory/1060-0-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

Filesize
9.9MB

Download
memory/1060-1-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/1060-2-0x000000001AB00000-0x000000001AB01000-memory.dmp

Filesize
4KB

Download
memory/1060-3-0x000000001AA20000-0x000000001AA21000-memory.dmp

Filesize
4KB

Download
memory/1060-4-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/1060-5-0x000000001B790000-0x000000001B791000-memory.dmp

Filesize
4KB

Download
memory/1060-6-0x000000001B3B0000-0x000000001B3B1000-memory.dmp

Filesize
4KB

Download
memory/1060-7-0x000000001B6C0000-0x000000001B6C1000-memory.dmp

Filesize
4KB

Download
memory/1060-10-0x000000001B700000-0x000000001B701000-memory.dmp

Filesize
4KB

Download
memory/1060-22-0x000000001B8C0000-0x000000001B8C1000-memory.dmp

Filesize
4KB

Download
memory/1060-23-0x000000001B8D0000-0x000000001B8D1000-memory.dmp

Filesize
4KB

Download