229bc74efaec13853ed9774d20581e3e56221d26f17c6ff6221722d9dfa80ba5

Analysis

Target

virtual_freer_v1.58/back/categories.ps1
Size

13KB
MD5

c405a726372ea0e2099e281004d258fa
SHA1

13f3a01b9d63046ed7ab9f22cb598580580a842d
SHA256

54d4349d91040b0e384132640f203a5e3fab9249221ffa51f4f058ce7d199663
SHA512

e3ad7e8249b273b60735990e204ff1a2a546dcd156f640230921dbd32a9078d79989ac82d775224cc0bf596a6ad32d71e2931843f1975ee71f680d42f271dd2b

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1900 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1900 powershell.exe

pid	process
1900	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1900	powershell.exe

memory/1900-54-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Filesize
8KB

Download
memory/1900-55-0x000007FEF4630000-0x000007FEF5053000-memory.dmp

Filesize
10.1MB

Download
memory/1900-57-0x0000000002424000-0x0000000002427000-memory.dmp

Filesize
12KB

Download
memory/1900-56-0x000007FEF3950000-0x000007FEF44AD000-memory.dmp

Filesize
11.4MB

Download
memory/1900-58-0x000000000242B000-0x000000000244A000-memory.dmp

Filesize
124KB

Download