3a7245ad086904c37686d967c01ff39ec3e08681aaff6fa2853445ca7870ec18

Analysis

max time kernel
173s
max time network
223s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:21

Target

申报农艺师相关表格及材料/各职称系列共用的/简明表填写注意事项(以讲师�.ps1
Size

99KB
MD5

783f0170b12eefcc6a83488cfa99bf84
SHA1

eb3d08ce8a4c51fb7d3b0ab3f6add975ea5e8cda
SHA256

c8cc119ccbc03d945509dd475b17db07e26d942121d7d724b4e46a7e858ad16b
SHA512

6af0951c9ae67fb80d336a4a507bc6b2e04a6aece91f7d44e4aeaf61e65f5948c1fcfe7caf112bfd943e3675c7c82590ec3fe3460ab613a5af52725eaa7c571c
SSDEEP

1536:gtj5NmmzHentjGVmsQzkr4W1gqLwJ7IXHLf3hnR/:g9bmmjAtjGFDLwJ7IXHL/

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3992 powershell.exe
3992 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3992 powershell.exe

pid	process
3992	powershell.exe
3992	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3992	powershell.exe

memory/3992-132-0x000001A08ACD0000-0x000001A08ACF2000-memory.dmp

Filesize
136KB

Download
memory/3992-133-0x00007FFC9AB30000-0x00007FFC9B5F1000-memory.dmp

Filesize
10.8MB

Download
memory/3992-134-0x00007FFC9AB30000-0x00007FFC9B5F1000-memory.dmp

Filesize
10.8MB

Download