078d03f798ce2c658d0fc1267ba141e836ca618e136c8f01b778f1e8bfb3721b

Resubmissions

28-11-2022 19:10

28-11-2022 19:09

28-11-2022 15:04

max time kernel
204s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 15:04

Target

fix/hypersensitiveness.ps1
Size

372B
MD5

66372a25352922e2fccd70bd7de22212
SHA1

ab25a17b152e3eddf61e3e076194fa40ebafa972
SHA256

072e68632cfb5a6db5f51cb84896b8f96827b18d81bedb858818e7d1ba46011f
SHA512

0ce33acb0b2aa55b8514623ebd3c72707544507a68ffa75e414f5287aceb76b334cf08aafe2bcfba359ccda9e1cfc4acd760eaec4c3adf759575bee7f75687f2

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1060 powershell.exe
1060 powershell.exe
1060 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1060 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1060	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1060 wrote to memory of 1288	1060	powershell.exe	rundll32.exe
PID 1060 wrote to memory of 1288	1060	powershell.exe	rundll32.exe
PID 1060 wrote to memory of 1288	1060	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\fix\hypersensitiveness.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\users\public\pickedKnelled.jpg DrawThemeIcon
  2⤵
  PID:1288

memory/1060-54-0x000007FEFC461000-0x000007FEFC463000-memory.dmp

Filesize
8KB

Download
memory/1060-55-0x000007FEF4120000-0x000007FEF4B43000-memory.dmp

Filesize
10.1MB

Download
memory/1060-57-0x0000000002764000-0x0000000002767000-memory.dmp

Filesize
12KB

Download
memory/1060-56-0x000007FEF35C0000-0x000007FEF411D000-memory.dmp

Filesize
11.4MB

Download
memory/1060-58-0x000000000276B000-0x000000000278A000-memory.dmp

Filesize
124KB

Download
memory/1060-60-0x0000000002764000-0x0000000002767000-memory.dmp

Filesize
12KB

Download
memory/1060-61-0x000000000276B000-0x000000000278A000-memory.dmp

Filesize
124KB

Download
memory/1288-59-0x0000000000000000-mapping.dmp

Download