71bdafbc74b249740cf4f9322d26e06ba15115565d31bc3e9357dbfb8b9a59e1

Analysis

max time kernel
19s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 23:32

Target

fix/glimpsed.ps1
Size

376B
MD5

79622867fd00d2ba17146086bfb1c26d
SHA1

5b65ea5a3200eb810adbad875bee2b7ac4ba90e8
SHA256

6d4127d7e7ef68ec872c0789b7c018bace75628f3fb848b6f41d072074446483
SHA512

fcc2199851ef8c5efa392729dd24654c58d0db3fba7d2921d668cd9a454acd336c6e3d5c3e8dbd94aed837e02daf667cf822c289815fcf18db93de9e4978fed5

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

628 powershell.exe
628 powershell.exe
628 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 628 powershell.exe

description	pid	process
Token: SeDebugPrivilege	628	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 628 wrote to memory of 564	628	powershell.exe	rundll32.exe
PID 628 wrote to memory of 564	628	powershell.exe	rundll32.exe
PID 628 wrote to memory of 564	628	powershell.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\eclipsedDismisses.jpg DrawThemeIcon
2⤵
PID:564

memory/564-60-0x0000000000000000-mapping.dmp

Download
memory/628-54-0x000007FEFBA41000-0x000007FEFBA43000-memory.dmp

Filesize
8KB

Download
memory/628-55-0x000007FEF3CD0000-0x000007FEF46F3000-memory.dmp

Filesize
10.1MB

Download
memory/628-57-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/628-56-0x000007FEF3170000-0x000007FEF3CCD000-memory.dmp

Filesize
11.4MB

Download
memory/628-58-0x000000001B820000-0x000000001BB1F000-memory.dmp

Filesize
3.0MB

Download
memory/628-59-0x000000000271B000-0x000000000273A000-memory.dmp

Filesize
124KB

Download
memory/628-61-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/628-62-0x000000000271B000-0x000000000273A000-memory.dmp

Filesize
124KB

Download