125726d3f9feeed75f6d885a638d6671ca997cb1947f429d39bd332fcd35e7ce

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 14:35

Target

fix/mummy.ps1
Size

375B
MD5

dbf28894fb58ea26193c70b40a51fa1b
SHA1

ee5b9086bd687d118e290072a1b35c398d919fba
SHA256

290c540176f7349262548213d2d78d6813e585d8981b0a948e8c9f2fffbd1cbc
SHA512

a4413bf676d4991bd500200168a7dcffeec5a96ae4f6608c9fbf7bec70307e7f79108d61dbe4c207712403eae35d4f44d1f06cba28e8a2c87dd6aba4e53947a6

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1652 powershell.exe
1652 powershell.exe
1652 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1652 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1652	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1652 wrote to memory of 944	1652	powershell.exe	rundll32.exe
PID 1652 wrote to memory of 944	1652	powershell.exe	rundll32.exe
PID 1652 wrote to memory of 944	1652	powershell.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\shockableVictors.jpg DrawThemeIcon
2⤵
PID:944

memory/944-59-0x0000000000000000-mapping.dmp

Download
memory/1652-54-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Filesize
8KB

Download
memory/1652-55-0x000007FEF3A90000-0x000007FEF44B3000-memory.dmp

Filesize
10.1MB

Download
memory/1652-57-0x0000000002784000-0x0000000002787000-memory.dmp

Filesize
12KB

Download
memory/1652-56-0x000007FEF2F30000-0x000007FEF3A8D000-memory.dmp

Filesize
11.4MB

Download
memory/1652-58-0x000000001B740000-0x000000001BA3F000-memory.dmp

Filesize
3.0MB

Download
memory/1652-60-0x000000000278B000-0x00000000027AA000-memory.dmp

Filesize
124KB

Download
memory/1652-62-0x000000000278B000-0x00000000027AA000-memory.dmp

Filesize
124KB

Download
memory/1652-61-0x0000000002784000-0x0000000002787000-memory.dmp

Filesize
12KB

Download