868d61ab45680a6fb0ee0cd78f47a39858a30e326c97ae8e1ff5d0937b6e54fc

Analysis

Target

dhl/dhl/core/autoload.php.ps1
Size

845B
MD5

90abcbe5f03aa3972e2530ff8cdd3c8b
SHA1

1a7490ed038eeb594e0c9fe70f28762d4cd096f0
SHA256

9b017150d9bf12b38a6d0c5d6ad5c1a7bf79a73726f192397dd652dda6a7f475
SHA512

f238ea9618b254612fe9f29bc98b5b6abea311f3779a43a11910e937a5d7a41486ffbb8eb4d4a77e0453160593bf5cc56c238ef6815b4d463cf35c3f58c69416

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

3260 powershell.exe
3260 powershell.exe
3260 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3260 powershell.exe

description	pid	process
Token: SeDebugPrivilege	3260	powershell.exe

memory/3260-121-0x00000126FB780000-0x00000126FB781000-memory.dmp

Filesize
4KB

Download
memory/3260-124-0x00000126FBA40000-0x00000126FBA41000-memory.dmp

Filesize
4KB

Download
memory/3260-128-0x00000126FB933000-0x00000126FB935000-memory.dmp

Filesize
8KB

Download
memory/3260-127-0x00000126FB930000-0x00000126FB932000-memory.dmp

Filesize
8KB

Download
memory/3260-137-0x00000126FB936000-0x00000126FB938000-memory.dmp

Filesize
8KB

Download