a1be8ab1061d8dfa7fc2b82e256971ee110695e776e493c96625935f9143aebd

Analysis

max time kernel
118s
max time network
49s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 16:15

Target

a1be8ab1061d8dfa7fc2b82e256971ee110695e776e493c96625935f9143aebd.ps1
Size

2KB
MD5

926e5a0589c28d9f9df27076309b69f1
SHA1

f8a7a8376ed133b6875d4f008f49b1799b2cbe68
SHA256

a1be8ab1061d8dfa7fc2b82e256971ee110695e776e493c96625935f9143aebd
SHA512

7bdc74249e1aa22fd0ed69c7709926e7137d386d61e00c958e8f12ec060980b482a69813ce3557ddbce901ac886ff0e2b30b2ddedc7f79b6c5c73eab7ee677ea

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

3 1168 powershell.exe
4 1168 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

1972 powershell.exe
1168 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1972 powershell.exe
Token: SeDebugPrivilege 1168 powershell.exe

flow	pid	process
3	1168	powershell.exe
4	1168	powershell.exe

pid	process
1972	powershell.exe
1168	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1972 wrote to memory of 1168	1972	powershell.exe	powershell.exe
PID 1972 wrote to memory of 1168	1972	powershell.exe	powershell.exe
PID 1972 wrote to memory of 1168	1972	powershell.exe	powershell.exe
PID 1972 wrote to memory of 1168	1972	powershell.exe	powershell.exe

memory/1168-59-0x0000000075371000-0x0000000075373000-memory.dmp

Filesize
8KB

Download
memory/1168-65-0x00000000730F0000-0x000000007369B000-memory.dmp

Filesize
5.7MB

Download
memory/1168-64-0x00000000730F0000-0x000000007369B000-memory.dmp

Filesize
5.7MB

Download
memory/1168-61-0x00000000730F0000-0x000000007369B000-memory.dmp

Filesize
5.7MB

Download
memory/1168-58-0x0000000000000000-mapping.dmp

Download
memory/1972-60-0x00000000024AB000-0x00000000024CA000-memory.dmp

Filesize
124KB

Download
memory/1972-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download
memory/1972-57-0x00000000024A4000-0x00000000024A7000-memory.dmp

Filesize
12KB

Download
memory/1972-62-0x00000000024A4000-0x00000000024A7000-memory.dmp

Filesize
12KB

Download
memory/1972-63-0x00000000024AB000-0x00000000024CA000-memory.dmp

Filesize
124KB

Download
memory/1972-56-0x000007FEF33A0000-0x000007FEF3EFD000-memory.dmp

Filesize
11.4MB

Download
memory/1972-55-0x000007FEF3F00000-0x000007FEF4923000-memory.dmp

Filesize
10.1MB

Download
memory/1972-66-0x00000000024A4000-0x00000000024A7000-memory.dmp

Filesize
12KB

Download
memory/1972-67-0x00000000024AB000-0x00000000024CA000-memory.dmp

Filesize
124KB

Download