ffe034f15c454937f32c626e66a5daaf27725a1b366604b61f9fb01198b22d14

Analysis

max time kernel
217s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 22:00

Target

fix/shareable.ps1
Size

370B
MD5

088202439bc5b1edbc9118c87fc11a06
SHA1

fbdc0e18625415e535f7cc01c3e2916da1f5d68c
SHA256

4677cee8cdfe912b2b6ac46611d2b4ea695204fa4fe60ca4105ee5ed11e6f634
SHA512

b02b7118b582955a6e77c489b5241218da1142efc6c53c57ce64de70e0e8dfb19b3cfe05f773296698899ffa421d4e76109e52fbec0f277d2a3479be5261c578

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

572 powershell.exe
572 powershell.exe
572 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 572 powershell.exe

description	pid	process
Token: SeDebugPrivilege	572	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 572 wrote to memory of 1592	572	powershell.exe	rundll32.exe
PID 572 wrote to memory of 1592	572	powershell.exe	rundll32.exe
PID 572 wrote to memory of 1592	572	powershell.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\humoringItd.jpg DrawThemeIcon
2⤵
PID:1592

memory/572-54-0x000007FEFC1E1000-0x000007FEFC1E3000-memory.dmp

Filesize
8KB

Download
memory/572-55-0x000007FEF4440000-0x000007FEF4E63000-memory.dmp

Filesize
10.1MB

Download
memory/572-57-0x0000000002644000-0x0000000002647000-memory.dmp

Filesize
12KB

Download
memory/572-56-0x000007FEF38E0000-0x000007FEF443D000-memory.dmp

Filesize
11.4MB

Download
memory/572-58-0x000000001B710000-0x000000001BA0F000-memory.dmp

Filesize
3.0MB

Download
memory/572-60-0x0000000002644000-0x0000000002647000-memory.dmp

Filesize
12KB

Download
memory/572-61-0x000000000264B000-0x000000000266A000-memory.dmp

Filesize
124KB

Download
memory/1592-59-0x0000000000000000-mapping.dmp

Download