dc32ec9f491669fd0748d31c67d23448a4f1f7394a238cdb1f03664d9ef5da26

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 15:05

Target

fix/lists.ps1
Size

378B
MD5

fafafcce585920be78cb3684595bcc6e
SHA1

3f42f4c6320ae4f38aae6c9e9f87e47ccc979bd0
SHA256

e678af2cc55046caf992f96fbee8d316134ab77132349631c0723c2f8c631f30
SHA512

1dd06abc2483d40e451c72d2dab6644c7866bd423a12e36e0aee655e73eb18693d987841cf9aea0df18a6ba74ac73664aae5667629e3cde95c1a8694a2892a8d

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

456 powershell.exe
456 powershell.exe
456 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 456 powershell.exe

description	pid	process
Token: SeDebugPrivilege	456	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 456 wrote to memory of 628	456	powershell.exe	rundll32.exe
PID 456 wrote to memory of 628	456	powershell.exe	rundll32.exe
PID 456 wrote to memory of 628	456	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\fix\lists.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\users\public\concoctionsInclosed.jpg DrawThemeIcon
  2⤵
  PID:628

memory/456-54-0x000007FEFB8A1000-0x000007FEFB8A3000-memory.dmp

Filesize
8KB

Download
memory/456-55-0x000007FEF34D0000-0x000007FEF3EF3000-memory.dmp

Filesize
10.1MB

Download
memory/456-57-0x0000000002574000-0x0000000002577000-memory.dmp

Filesize
12KB

Download
memory/456-56-0x000007FEF2330000-0x000007FEF2E8D000-memory.dmp

Filesize
11.4MB

Download
memory/456-58-0x000000001B830000-0x000000001BB2F000-memory.dmp

Filesize
3.0MB

Download
memory/456-59-0x000000000257B000-0x000000000259A000-memory.dmp

Filesize
124KB

Download
memory/456-61-0x0000000002574000-0x0000000002577000-memory.dmp

Filesize
12KB

Download
memory/456-62-0x000000000257B000-0x000000000259A000-memory.dmp

Filesize
124KB

Download
memory/628-60-0x0000000000000000-mapping.dmp

Download