a66f6ec5d504f0e6fb16ca39d148754e8528413804fe7dcfae7bef1800192e79

Analysis

max time kernel
97s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-08-2022 09:52

Target

2.ps1
Size

3KB
MD5

09cc9c560e20d0c8011f77c30c9cc21d
SHA1

16c9bedf2d4def01ce8dae29ef979549e508db38
SHA256

a66f6ec5d504f0e6fb16ca39d148754e8528413804fe7dcfae7bef1800192e79
SHA512

6a479d6963a031551b9339008280a491c259393233130e8989ccbecb6b9649ed4c417b7a5783812adbcd322ebb6f592a2ccbb80aaa55b2713ebf909662d306ea

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 1416 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

1676 powershell.exe
1416 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1676 powershell.exe
Token: SeDebugPrivilege 1416 powershell.exe

flow	pid	process
4	1416	powershell.exe

pid	process
1676	powershell.exe
1416	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	1416	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1676 wrote to memory of 1416	1676	powershell.exe	powershell.exe
PID 1676 wrote to memory of 1416	1676	powershell.exe	powershell.exe
PID 1676 wrote to memory of 1416	1676	powershell.exe	powershell.exe
PID 1676 wrote to memory of 1416	1676	powershell.exe	powershell.exe

memory/1416-59-0x0000000000000000-mapping.dmp

Download
memory/1416-66-0x0000000073AB0000-0x000000007405B000-memory.dmp

Filesize
5.7MB

Download
memory/1416-65-0x0000000073AB0000-0x000000007405B000-memory.dmp

Filesize
5.7MB

Download
memory/1416-62-0x0000000073AB0000-0x000000007405B000-memory.dmp

Filesize
5.7MB

Download
memory/1416-61-0x0000000075D91000-0x0000000075D93000-memory.dmp

Filesize
8KB

Download
memory/1676-60-0x000000000282B000-0x000000000284A000-memory.dmp

Filesize
124KB

Download
memory/1676-54-0x000007FEFC491000-0x000007FEFC493000-memory.dmp

Filesize
8KB

Download
memory/1676-58-0x000000001B760000-0x000000001BA5F000-memory.dmp

Filesize
3.0MB

Download
memory/1676-57-0x0000000002824000-0x0000000002827000-memory.dmp

Filesize
12KB

Download
memory/1676-63-0x0000000002824000-0x0000000002827000-memory.dmp

Filesize
12KB

Download
memory/1676-64-0x000000000282B000-0x000000000284A000-memory.dmp

Filesize
124KB

Download
memory/1676-56-0x000007FEF3410000-0x000007FEF3F6D000-memory.dmp

Filesize
11.4MB

Download
memory/1676-55-0x000007FEF3F70000-0x000007FEF4993000-memory.dmp

Filesize
10.1MB

Download
memory/1676-67-0x0000000002824000-0x0000000002827000-memory.dmp

Filesize
12KB

Download
memory/1676-68-0x000000000282B000-0x000000000284A000-memory.dmp

Filesize
124KB

Download