692ad829cb6c9788998acb106ea4d8311e432c866d082ac3cc117166ac50080d

Resubmissions

04-06-2022 11:20

03-06-2022 12:14

Target

1662.ps1
Size

192KB
MD5

3f5498ca9c0d3d185bc45edf45185d07
SHA1

f945b742489e29dff58fd41a4f6293b6deb57533
SHA256

caa1268740d0b48795621f8d0e127fd4574c87de5c16f5348fadc97866d1de39
SHA512

34849f297613c9c2b284704e65701aa88ded0ccea1956d55233a052810149b81489c4e7b6bd0416b53d394ec676221527fbe700434756ed04827b5b9bad0334c

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

892 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 892 powershell.exe

pid	process
892	powershell.exe

description	pid	process
Token: SeDebugPrivilege	892	powershell.exe

memory/892-54-0x000007FEFBB11000-0x000007FEFBB13000-memory.dmp

Filesize
8KB

Download
memory/892-55-0x000007FEF3790000-0x000007FEF41B3000-memory.dmp

Filesize
10.1MB

Download
memory/892-56-0x000007FEF2C30000-0x000007FEF378D000-memory.dmp

Filesize
11.4MB

Download
memory/892-58-0x000007FEF41C0000-0x000007FEF509C000-memory.dmp

Filesize
14.9MB

Download
memory/892-57-0x000000001B710000-0x000000001BA0F000-memory.dmp

Filesize
3.0MB

Download
memory/892-59-0x000007FEF3790000-0x000007FEF41B3000-memory.dmp

Filesize
10.1MB

Download
memory/892-61-0x0000000002944000-0x0000000002947000-memory.dmp

Filesize
12KB

Download
memory/892-60-0x000007FEFAD30000-0x000007FEFADE2000-memory.dmp

Filesize
712KB

Download
memory/892-62-0x000007FEF2C30000-0x000007FEF378D000-memory.dmp

Filesize
11.4MB

Download
memory/892-63-0x000007FEF60B0000-0x000007FEF63DE000-memory.dmp

Filesize
3.2MB

Download
memory/892-64-0x000007FEFB040000-0x000007FEFB0A9000-memory.dmp

Filesize
420KB

Download
memory/892-65-0x000007FEFAEF0000-0x000007FEFAF22000-memory.dmp

Filesize
200KB

Download