e475114b48fb4836b0d813bf67267ab564d8e48d30f324b725da409406fe36db

General

Target

e475114b48fb4836b0d813bf67267ab564d8e48d30f324b725da409406fe36db.ps1
Size

60KB
MD5

e06b27212da5e1a04b918c9b9a0c3d8c
SHA1

d7f82ec85d738cb42849ded21452221bbce51157
SHA256

e475114b48fb4836b0d813bf67267ab564d8e48d30f324b725da409406fe36db
SHA512

8f16b7cad649f8d7f2653782db8564a7545f102aaa6a02eee82b1c2a18604e6dde6461b1347e168dbdd1a787b639221dbc93fcbf278679bf4175c47aefbed1a1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 728 set thread context of 1288 728 powershell.exe RegSvcs.exe

description	pid	process	target process
PID 728 set thread context of 1288	728	powershell.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

powershell.exeRegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 728 powershell.exe
Token: SeDebugPrivilege 1288 RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	728	powershell.exe
Token: SeDebugPrivilege	1288	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 728 wrote to memory of 1288	728	powershell.exe	RegSvcs.exe
PID 728 wrote to memory of 1288	728	powershell.exe	RegSvcs.exe
PID 728 wrote to memory of 1288	728	powershell.exe	RegSvcs.exe
PID 728 wrote to memory of 1288	728	powershell.exe	RegSvcs.exe
PID 728 wrote to memory of 1288	728	powershell.exe	RegSvcs.exe
PID 728 wrote to memory of 1288	728	powershell.exe	RegSvcs.exe
PID 728 wrote to memory of 1288	728	powershell.exe	RegSvcs.exe
PID 728 wrote to memory of 1288	728	powershell.exe	RegSvcs.exe
PID 728 wrote to memory of 1288	728	powershell.exe	RegSvcs.exe
PID 728 wrote to memory of 1288	728	powershell.exe	RegSvcs.exe
PID 728 wrote to memory of 1288	728	powershell.exe	RegSvcs.exe
PID 728 wrote to memory of 1288	728	powershell.exe	RegSvcs.exe

memory/728-2-0x000007FEF61E0000-0x000007FEF6BCC000-memory.dmp

Filesize
9.9MB

Download
memory/728-3-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/728-4-0x000000001ACE0000-0x000000001ACE1000-memory.dmp

Filesize
4KB

Download
memory/728-5-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/728-6-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/728-7-0x0000000002440000-0x0000000002443000-memory.dmp

Filesize
12KB

Download
memory/1288-9-0x00000000004051BE-mapping.dmp

Download
memory/1288-8-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1288-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1288-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1288-12-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download