078d03f798ce2c658d0fc1267ba141e836ca618e136c8f01b778f1e8bfb3721b

Resubmissions

28-11-2022 19:10

28-11-2022 19:09

28-11-2022 15:04

max time kernel
605s
max time network
635s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 19:10

Target

fix/hypersensitiveness.ps1
Size

372B
MD5

66372a25352922e2fccd70bd7de22212
SHA1

ab25a17b152e3eddf61e3e076194fa40ebafa972
SHA256

072e68632cfb5a6db5f51cb84896b8f96827b18d81bedb858818e7d1ba46011f
SHA512

0ce33acb0b2aa55b8514623ebd3c72707544507a68ffa75e414f5287aceb76b334cf08aafe2bcfba359ccda9e1cfc4acd760eaec4c3adf759575bee7f75687f2

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

820 powershell.exe
820 powershell.exe
820 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 820 powershell.exe

description	pid	process
Token: SeDebugPrivilege	820	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 820 wrote to memory of 676	820	powershell.exe	rundll32.exe
PID 820 wrote to memory of 676	820	powershell.exe	rundll32.exe
PID 820 wrote to memory of 676	820	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\fix\hypersensitiveness.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\users\public\pickedKnelled.jpg DrawThemeIcon
  2⤵
  PID:676

memory/676-59-0x0000000000000000-mapping.dmp

Download
memory/820-54-0x000007FEFBAC1000-0x000007FEFBAC3000-memory.dmp

Filesize
8KB

Download
memory/820-55-0x000007FEF3680000-0x000007FEF40A3000-memory.dmp

Filesize
10.1MB

Download
memory/820-56-0x000007FEF2B20000-0x000007FEF367D000-memory.dmp

Filesize
11.4MB

Download
memory/820-57-0x00000000025C4000-0x00000000025C7000-memory.dmp

Filesize
12KB

Download
memory/820-58-0x00000000025CB000-0x00000000025EA000-memory.dmp

Filesize
124KB

Download
memory/820-60-0x00000000025C4000-0x00000000025C7000-memory.dmp

Filesize
12KB

Download
memory/820-61-0x00000000025CB000-0x00000000025EA000-memory.dmp

Filesize
124KB

Download