07b4430bee4ea392505c4215adcf542e34b37f16ac11e35c7b3338eaf11c9815

Analysis

max time kernel
9s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 04:51

Target

fix/backlogs.ps1
Size

371B
MD5

fefd1656933426b67f7d386706fa8649
SHA1

f10dd69df4dc476328f63206ee50ab69d5177ca6
SHA256

cea4bb80a795490d0ffcbba3d581d1451bc5a2743ecb15f44f815c32196d3942
SHA512

b11c8cdc587ef8ae57d9a97afdd88756c606184e217c32073aab77f261239e19d9f689f8d5d5549560fa85dc587a153f3ab2c97cc5c55cae8a974df0978ddc6c

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1156 powershell.exe
1156 powershell.exe
1156 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1156 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1156	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1156 wrote to memory of 576	1156	powershell.exe	rundll32.exe
PID 1156 wrote to memory of 576	1156	powershell.exe	rundll32.exe
PID 1156 wrote to memory of 576	1156	powershell.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\foodStunting.jpg DrawThemeIcon
2⤵
PID:576

memory/576-60-0x0000000000000000-mapping.dmp

Download
memory/1156-54-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Filesize
8KB

Download
memory/1156-55-0x000007FEF3550000-0x000007FEF3F73000-memory.dmp

Filesize
10.1MB

Download
memory/1156-57-0x0000000002874000-0x0000000002877000-memory.dmp

Filesize
12KB

Download
memory/1156-56-0x000007FEF29F0000-0x000007FEF354D000-memory.dmp

Filesize
11.4MB

Download
memory/1156-58-0x000000001B6F0000-0x000000001B9EF000-memory.dmp

Filesize
3.0MB

Download
memory/1156-59-0x000000000287B000-0x000000000289A000-memory.dmp

Filesize
124KB

Download
memory/1156-61-0x0000000002874000-0x0000000002877000-memory.dmp

Filesize
12KB

Download
memory/1156-62-0x000000000287B000-0x000000000289A000-memory.dmp

Filesize
124KB

Download