7f694a4fe0cac04027b1b81d634eeba8b9b7f37f801721a885ef9e1392d5f403

Analysis

max time kernel
36s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:12

Target

fix/soapy.ps1
Size

380B
MD5

a95994f64d98fe3150d1bfd64faaeb33
SHA1

59ccc5d980e1aaf3452f3899762f91fb050b0da5
SHA256

1aad9e1057dec6f512e034b684620257a9401c5819ade9235587fb59970a0360
SHA512

7b6a9bedcb4ab7edafdec046257859b55e9a10015f7c7b482fb359bf7e3925ec29587a453876cf3034f7b81822404c21f67b8bc2ebc3364d9360a44df8ae9ae7

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1708 powershell.exe
1708 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1708 powershell.exe

pid	process
1708	powershell.exe
1708	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1708	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1708 wrote to memory of 1964	1708	powershell.exe	rundll32.exe
PID 1708 wrote to memory of 1964	1708	powershell.exe	rundll32.exe
PID 1708 wrote to memory of 1964	1708	powershell.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\discountingProspectus.jpg DrawThemeIcon
2⤵
PID:1964

memory/1708-54-0x000007FEFBD81000-0x000007FEFBD83000-memory.dmp

Filesize
8KB

Download
memory/1708-55-0x000007FEF3990000-0x000007FEF43B3000-memory.dmp

Filesize
10.1MB

Download
memory/1708-56-0x0000000002844000-0x0000000002847000-memory.dmp

Filesize
12KB

Download
memory/1708-57-0x000007FEF2E30000-0x000007FEF398D000-memory.dmp

Filesize
11.4MB

Download
memory/1708-58-0x000000000284B000-0x000000000286A000-memory.dmp

Filesize
124KB

Download
memory/1708-60-0x0000000002844000-0x0000000002847000-memory.dmp

Filesize
12KB

Download
memory/1708-61-0x000000000284B000-0x000000000286A000-memory.dmp

Filesize
124KB

Download
memory/1964-59-0x0000000000000000-mapping.dmp

Download