fe3cc52e8f9d230c5c1aa6c442a4b9c37dd4b8ec6954b989dff4702dd1a8b724

Analysis

max time kernel
103s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:20

Target

申报助理研究员（自然科学、社会科学）相关表格及材料/各职称系列共用的.ps1
Size

99KB
MD5

783f0170b12eefcc6a83488cfa99bf84
SHA1

eb3d08ce8a4c51fb7d3b0ab3f6add975ea5e8cda
SHA256

c8cc119ccbc03d945509dd475b17db07e26d942121d7d724b4e46a7e858ad16b
SHA512

6af0951c9ae67fb80d336a4a507bc6b2e04a6aece91f7d44e4aeaf61e65f5948c1fcfe7caf112bfd943e3675c7c82590ec3fe3460ab613a5af52725eaa7c571c
SSDEEP

1536:gtj5NmmzHentjGVmsQzkr4W1gqLwJ7IXHLf3hnR/:g9bmmjAtjGFDLwJ7IXHL/

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1624 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1624 powershell.exe

pid	process
1624	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1624	powershell.exe

memory/1624-54-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Filesize
8KB

Download
memory/1624-55-0x000007FEF3930000-0x000007FEF4353000-memory.dmp

Filesize
10.1MB

Download
memory/1624-57-0x0000000002954000-0x0000000002957000-memory.dmp

Filesize
12KB

Download
memory/1624-56-0x000007FEF2DD0000-0x000007FEF392D000-memory.dmp

Filesize
11.4MB

Download
memory/1624-58-0x000000001B900000-0x000000001BBFF000-memory.dmp

Filesize
3.0MB

Download
memory/1624-59-0x0000000002954000-0x0000000002957000-memory.dmp

Filesize
12KB

Download
memory/1624-60-0x000000000295B000-0x000000000297A000-memory.dmp

Filesize
124KB

Download