555ef79470ddd48be26d41437e93f077a8cce8598ae896a7b9931b1c998057ce

Analysis

max time kernel
140s
max time network
103s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 16:15

Target

test.ps1
Size

2KB
MD5

926e5a0589c28d9f9df27076309b69f1
SHA1

f8a7a8376ed133b6875d4f008f49b1799b2cbe68
SHA256

a1be8ab1061d8dfa7fc2b82e256971ee110695e776e493c96625935f9143aebd
SHA512

7bdc74249e1aa22fd0ed69c7709926e7137d386d61e00c958e8f12ec060980b482a69813ce3557ddbce901ac886ff0e2b30b2ddedc7f79b6c5c73eab7ee677ea

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

4 1200 powershell.exe
5 1200 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

1924 powershell.exe
1200 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1924 powershell.exe
Token: SeDebugPrivilege 1200 powershell.exe

flow	pid	process
4	1200	powershell.exe
5	1200	powershell.exe

pid	process
1924	powershell.exe
1200	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1924 wrote to memory of 1200	1924	powershell.exe	powershell.exe
PID 1924 wrote to memory of 1200	1924	powershell.exe	powershell.exe
PID 1924 wrote to memory of 1200	1924	powershell.exe	powershell.exe
PID 1924 wrote to memory of 1200	1924	powershell.exe	powershell.exe

memory/1200-59-0x0000000000000000-mapping.dmp

Download
memory/1200-66-0x0000000072B60000-0x000000007310B000-memory.dmp

Filesize
5.7MB

Download
memory/1200-65-0x0000000072B60000-0x000000007310B000-memory.dmp

Filesize
5.7MB

Download
memory/1200-62-0x0000000072B60000-0x000000007310B000-memory.dmp

Filesize
5.7MB

Download
memory/1200-60-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/1924-56-0x000007FEF2EF0000-0x000007FEF3A4D000-memory.dmp

Filesize
11.4MB

Download
memory/1924-58-0x000000001B790000-0x000000001BA8F000-memory.dmp

Filesize
3.0MB

Download
memory/1924-61-0x00000000026AB000-0x00000000026CA000-memory.dmp

Filesize
124KB

Download
memory/1924-54-0x000007FEFB541000-0x000007FEFB543000-memory.dmp

Filesize
8KB

Download
memory/1924-63-0x00000000026A4000-0x00000000026A7000-memory.dmp

Filesize
12KB

Download
memory/1924-64-0x00000000026AB000-0x00000000026CA000-memory.dmp

Filesize
124KB

Download
memory/1924-57-0x00000000026A4000-0x00000000026A7000-memory.dmp

Filesize
12KB

Download
memory/1924-55-0x000007FEF3A50000-0x000007FEF4473000-memory.dmp

Filesize
10.1MB

Download
memory/1924-67-0x00000000026A4000-0x00000000026A7000-memory.dmp

Filesize
12KB

Download
memory/1924-68-0x00000000026AB000-0x00000000026CA000-memory.dmp

Filesize
124KB

Download