c78468e0c0080700cb378ddb67268ebaa0d5a036f192a70e604a5076682474f9

Analysis

Target

f5068e95e11b906cf33949376159ed87e03eb29e774029e84b8151c76d69ccf4/Downloaded_files/__PSScriptPolicyTest_eg4nc2yx.0nl.ps1
Size

81B
MD5

b2d34bf360c7c2474aed6b63664d2712
SHA1

7e7ab30d6f902fd37806dcd58913ee62369225dd
SHA256

68ac98e66c15cbdc9e676a2bd04db0b4d9db3a9cdc916c2da1c962e719655d48
SHA512

ab99915e7dc64f6f0e4173c2c6283e45b3af4931fbf6e454c8c983ee1fd86cf66d8ff80f50cf50421d1af71b7358045bc73960ed866f5da0b74b2f5bac7c0e4f

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4628 powershell.exe
4628 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4628 powershell.exe

pid	process
4628	powershell.exe
4628	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4628	powershell.exe

memory/4628-130-0x0000025A68880000-0x0000025A688A2000-memory.dmp

Filesize
136KB

Download
memory/4628-131-0x00007FFE58640000-0x00007FFE59101000-memory.dmp

Filesize
10.8MB

Download
memory/4628-132-0x00007FFE58640000-0x00007FFE59101000-memory.dmp

Filesize
10.8MB

Download