8635911b8839322e420f9b53a075642e91ef3c71176109ab0a73df78345b56ae

Analysis

max time kernel
1608s
max time network
1611s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 18:54

Target

tps1.ps1
Size

170B
MD5

299563c5074a9a77e4e0b85240d4237c
SHA1

ac5bdbe219f4da3378cc1ac27e9f8c6496bea970
SHA256

24610513b3eef44c19a79b0b769076ecdf7e0e25c556c0f5de5c50e18c29200b
SHA512

3768aa232326c4864c92326dc52b2fc8959e9e843ab8b22f78168fad033843e16759fdbe171bfcc2834f8d46bd61a6aa9ab0e68695237dc062eed284e8da5549

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
832	powershell.exe
832	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	832	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 936	832	powershell.exe	28
PID 832 wrote to memory of 936	832	powershell.exe	28
PID 832 wrote to memory of 936	832	powershell.exe	28

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\tps1.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" /s c:\windows\tasks\bb.dll,BasicLoad
  2⤵
  PID:936

memory/832-54-0x000007FEFB751000-0x000007FEFB753000-memory.dmp

Filesize
8KB

Download
memory/832-55-0x000007FEF33D0000-0x000007FEF3DF3000-memory.dmp

Filesize
10.1MB

Download
memory/832-57-0x00000000023D4000-0x00000000023D7000-memory.dmp

Filesize
12KB

Download
memory/832-56-0x000007FEF2870000-0x000007FEF33CD000-memory.dmp

Filesize
11.4MB

Download
memory/832-59-0x00000000023D4000-0x00000000023D7000-memory.dmp

Filesize
12KB

Download
memory/832-60-0x00000000023DB000-0x00000000023FA000-memory.dmp

Filesize
124KB

Download