e8d3a989dd5bc39bc775c3f1d2be74487e8dbf7333189eab69fa53b0931988a9

Analysis

max time kernel
64s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 16:23

Target

fix/pretensions.ps1
Size

374B
MD5

6f6fe255da507e428e33ab07640c0d2d
SHA1

13071243a33a210f1a369e338cfc4af035d4722c
SHA256

6702d98c1e67a5eae3c1a29646286d327529fef82efc7864ae646bb4bef87262
SHA512

7fc02bd2071fdea7b1519035fa3f3b8a251d641a2539400efded8439e953871a178444e7890b1e6ca901d10372859c787fbb567efd65e8d39c8aba6089c4cf8e

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1452 powershell.exe
1452 powershell.exe
1452 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1452 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1452	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1452 wrote to memory of 1188	1452	powershell.exe	rundll32.exe
PID 1452 wrote to memory of 1188	1452	powershell.exe	rundll32.exe
PID 1452 wrote to memory of 1188	1452	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\fix\pretensions.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\users\public\rarePollinating.jpg DrawThemeIcon
  2⤵
  PID:1188

memory/1188-59-0x0000000000000000-mapping.dmp

Download
memory/1452-54-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

Filesize
8KB

Download
memory/1452-55-0x000007FEF3ED0000-0x000007FEF48F3000-memory.dmp

Filesize
10.1MB

Download
memory/1452-57-0x0000000002984000-0x0000000002987000-memory.dmp

Filesize
12KB

Download
memory/1452-56-0x000007FEF32B0000-0x000007FEF3E0D000-memory.dmp

Filesize
11.4MB

Download
memory/1452-58-0x000000000298B000-0x00000000029AA000-memory.dmp

Filesize
124KB

Download
memory/1452-60-0x0000000002984000-0x0000000002987000-memory.dmp

Filesize
12KB

Download
memory/1452-61-0x000000000298B000-0x00000000029AA000-memory.dmp

Filesize
124KB

Download