3351388925f4f2804abd5216c06371042c5f89633937a1a80ec0cf7b532884b0

Analysis

max time kernel
34s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 12:52

Target

fix/purveys.ps1
Size

377B
MD5

55087f66c4bca6179d168c15bd8b2a7c
SHA1

c473fb8ea0ca0afe187eb339c4bf0cd6aaff7e0f
SHA256

94f086a1ba63dab1b2b4dcaf9af8ede015bb05015e071cfece02b3e01fbfadc3
SHA512

7ae54fa738851b4ad72ccef4bf1c439c2aeddf33c177ca998e32382dd3a7099c7e224d45c0f9dd39111290784ce0fe924224e49b0e144d7ebe93d4bead5c9c27

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1112 powershell.exe
1112 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1112 powershell.exe

pid	process
1112	powershell.exe
1112	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1112	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1112 wrote to memory of 880	1112	powershell.exe	rundll32.exe
PID 1112 wrote to memory of 880	1112	powershell.exe	rundll32.exe
PID 1112 wrote to memory of 880	1112	powershell.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\clerkParenthetical.jpg DrawThemeIcon
2⤵
PID:880

memory/880-60-0x0000000000000000-mapping.dmp

Download
memory/1112-54-0x000007FEFBCC1000-0x000007FEFBCC3000-memory.dmp

Filesize
8KB

Download
memory/1112-55-0x000007FEF3940000-0x000007FEF4363000-memory.dmp

Filesize
10.1MB

Download
memory/1112-57-0x0000000002AC4000-0x0000000002AC7000-memory.dmp

Filesize
12KB

Download
memory/1112-56-0x000007FEF2DE0000-0x000007FEF393D000-memory.dmp

Filesize
11.4MB

Download
memory/1112-58-0x000000001B810000-0x000000001BB0F000-memory.dmp

Filesize
3.0MB

Download
memory/1112-59-0x0000000002ACB000-0x0000000002AEA000-memory.dmp

Filesize
124KB

Download
memory/1112-61-0x0000000002AC4000-0x0000000002AC7000-memory.dmp

Filesize
12KB

Download
memory/1112-62-0x0000000002ACB000-0x0000000002AEA000-memory.dmp

Filesize
124KB

Download