fe3cc52e8f9d230c5c1aa6c442a4b9c37dd4b8ec6954b989dff4702dd1a8b724

Analysis

max time kernel
174s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:20

Target

申报助理研究员（自然科学、社会科学）相关表格及材料/各职称系列共用的.ps1
Size

99KB
MD5

783f0170b12eefcc6a83488cfa99bf84
SHA1

eb3d08ce8a4c51fb7d3b0ab3f6add975ea5e8cda
SHA256

c8cc119ccbc03d945509dd475b17db07e26d942121d7d724b4e46a7e858ad16b
SHA512

6af0951c9ae67fb80d336a4a507bc6b2e04a6aece91f7d44e4aeaf61e65f5948c1fcfe7caf112bfd943e3675c7c82590ec3fe3460ab613a5af52725eaa7c571c
SSDEEP

1536:gtj5NmmzHentjGVmsQzkr4W1gqLwJ7IXHLf3hnR/:g9bmmjAtjGFDLwJ7IXHL/

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

2432 powershell.exe
2432 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2432 powershell.exe

pid	process
2432	powershell.exe
2432	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2432	powershell.exe

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ec 0x2cc
1⤵
PID:1868

memory/2432-132-0x000001A9F1540000-0x000001A9F1562000-memory.dmp

Filesize
136KB

Download
memory/2432-133-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

Filesize
10.8MB

Download
memory/2432-134-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

Filesize
10.8MB

Download