159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

Target

VF_SingleOffice.ps1
Size

12KB
MD5

7fb16188e5c14aa3baf1a10a9e3355f3
SHA1

d16e4f846f77803aa0060a9a0948184787bdb3f0
SHA256

7560f24452c7c9a57e58e88398219e16c3293be04009370adce749ad59c3be43
SHA512

41325de5bba10f9b18f563b0ebca04a2c497ffcbc77c7b14829bf17537be0458fe2fb373528fe799e5fc4252b1a5f2025ee08e46c42ec06d8cea260ba62513b4

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1420 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1420 powershell.exe

pid	process
1420	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1420	powershell.exe

memory/1420-0-0x000007FEF66A0000-0x000007FEF708C000-memory.dmp

Filesize
9.9MB

Download
memory/1420-1-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/1420-2-0x000000001AB20000-0x000000001AB21000-memory.dmp

Filesize
4KB

Download
memory/1420-3-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/1420-4-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/1420-5-0x000000001C380000-0x000000001C381000-memory.dmp

Filesize
4KB

Download
memory/1420-6-0x000000001B940000-0x000000001B941000-memory.dmp

Filesize
4KB

Download
memory/1420-7-0x000000001B3D0000-0x000000001B3D1000-memory.dmp

Filesize
4KB

Download
memory/1420-10-0x000000001C450000-0x000000001C451000-memory.dmp

Filesize
4KB

Download
memory/1420-22-0x000000001B820000-0x000000001B821000-memory.dmp

Filesize
4KB

Download
memory/1420-23-0x000000001B8F0000-0x000000001B8F1000-memory.dmp

Filesize
4KB

Download