501e90d690942737a5c6756efd9553e8c553455681a448a12483e6227073aa9d

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 06:07

Target
fix/unwatermarked.ps1
Size 369B
Sample221129-gva6mscd35
SHA256 056deb6e3f5de68f9ae2b1ed11f7d3d398a3488387294937bebcb0f8f847b5c9
MD5 ee1dae7f9bc8d29ac9de9c0482413600
SHA1 b8228275bd599badebaf9206f0328b2439f8599c
SHA512 de24d1a6c95206d71ef0d75b1ea2f202b97ac168170809eab298be028c61374a989809e5ac0c6da84a3edd989a8dd166c21ac230e5c073e94181022886534b93
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1768	powershell.exe
1768	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1236	1768	powershell.exe	28
PID 1768 wrote to memory of 1236	1768	powershell.exe	28
PID 1768 wrote to memory of 1236	1768	powershell.exe	28

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\fix\unwatermarked.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\users\public\agreeBrood.jpg DrawThemeIcon
  2⤵
  PID:1236

memory/1768-54-0x000007FEFB621000-0x000007FEFB623000-memory.dmp

Download

memory/1768-55-0x000007FEF35E0000-0x000007FEF4003000-memory.dmp

Download

memory/1768-56-0x000007FEF2A80000-0x000007FEF35DD000-memory.dmp

Download

memory/1768-57-0x000000001B720000-0x000000001BA1F000-memory.dmp

Download

memory/1768-60-0x00000000022AB000-0x00000000022CA000-memory.dmp

Download

memory/1768-59-0x00000000022A4000-0x00000000022A7000-memory.dmp

Download