60ec6016e755fe7939b9707e0a41bc1c7c12e9279ca34331057269c9e73be381

Analysis

max time kernel
34s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 11:52

Target

fix/cowl.ps1
Size

372B
MD5

a4c8c036554ea25d5ac87e0a29c5ef26
SHA1

f18c585985f8968cfb69bcb2b3143918ea542b6d
SHA256

5d9fb9c3365714b149cec1a109162e04c78d0b818e95341df296663c225eff5f
SHA512

7c0c7b44c8d509330302bf77d22a7c7e0d4f9de9ae3b8c6a3bc72153cd95c7ee658da6c49e897976bd4b43623d0dbe770df52526abb7bc85f81effc39fe4ba3d

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1608 powershell.exe
1608 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1608 powershell.exe

pid	process
1608	powershell.exe
1608	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1608	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1608 wrote to memory of 1944	1608	powershell.exe	rundll32.exe
PID 1608 wrote to memory of 1944	1608	powershell.exe	rundll32.exe
PID 1608 wrote to memory of 1944	1608	powershell.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\termagancyImf.jpg DrawThemeIcon
2⤵
PID:1944

memory/1608-54-0x000007FEFBB21000-0x000007FEFBB23000-memory.dmp

Filesize
8KB

Download
memory/1608-55-0x000007FEF37A0000-0x000007FEF41C3000-memory.dmp

Filesize
10.1MB

Download
memory/1608-57-0x0000000002514000-0x0000000002517000-memory.dmp

Filesize
12KB

Download
memory/1608-56-0x000007FEF2C40000-0x000007FEF379D000-memory.dmp

Filesize
11.4MB

Download
memory/1608-58-0x000000000251B000-0x000000000253A000-memory.dmp

Filesize
124KB

Download
memory/1608-60-0x0000000002514000-0x0000000002517000-memory.dmp

Filesize
12KB

Download
memory/1608-61-0x000000000251B000-0x000000000253A000-memory.dmp

Filesize
124KB

Download
memory/1944-59-0x0000000000000000-mapping.dmp

Download