3a7245ad086904c37686d967c01ff39ec3e08681aaff6fa2853445ca7870ec18

Analysis

max time kernel
11s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:21

Target

申报农艺师相关表格及材料/各职称系列共用的/简明表填写注意事项(以讲师�.ps1
Size

99KB
MD5

783f0170b12eefcc6a83488cfa99bf84
SHA1

eb3d08ce8a4c51fb7d3b0ab3f6add975ea5e8cda
SHA256

c8cc119ccbc03d945509dd475b17db07e26d942121d7d724b4e46a7e858ad16b
SHA512

6af0951c9ae67fb80d336a4a507bc6b2e04a6aece91f7d44e4aeaf61e65f5948c1fcfe7caf112bfd943e3675c7c82590ec3fe3460ab613a5af52725eaa7c571c
SSDEEP

1536:gtj5NmmzHentjGVmsQzkr4W1gqLwJ7IXHLf3hnR/:g9bmmjAtjGFDLwJ7IXHL/

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1892 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1892 powershell.exe

pid	process
1892	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1892	powershell.exe

memory/1892-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download
memory/1892-55-0x000007FEF35B0000-0x000007FEF3FD3000-memory.dmp

Filesize
10.1MB

Download
memory/1892-56-0x000007FEF2A50000-0x000007FEF35AD000-memory.dmp

Filesize
11.4MB

Download
memory/1892-57-0x0000000002504000-0x0000000002507000-memory.dmp

Filesize
12KB

Download
memory/1892-58-0x000000001B720000-0x000000001BA1F000-memory.dmp

Filesize
3.0MB

Download
memory/1892-59-0x0000000002504000-0x0000000002507000-memory.dmp

Filesize
12KB

Download
memory/1892-60-0x000000000250B000-0x000000000252A000-memory.dmp

Filesize
124KB

Download