8f974baab53f9cdf8ac1b5ab044d237aff6792384f086b02bd2437fa4d8d3326

Analysis

max time kernel
233s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 16:54

Target

fix/inimicable.ps1
Size

375B
MD5

19df978eea48893f7660a7780d758c76
SHA1

df345ac42ef270fe4da4c5220e377e26999624d4
SHA256

be00e2c2865435f34a4163b68a12c9caa24489304a77e356971ae39d566f0a3b
SHA512

b892c8bcf8355cc837123664a085877db643aa8321d58fb2b5445326246ca1815cb2b36d565cf62a9b4d618f023f7ec012486b8d5de09add2eda2695fbe876db

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

664 powershell.exe
664 powershell.exe
664 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 664 powershell.exe

description	pid	process
Token: SeDebugPrivilege	664	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 664 wrote to memory of 1776	664	powershell.exe	rundll32.exe
PID 664 wrote to memory of 1776	664	powershell.exe	rundll32.exe
PID 664 wrote to memory of 1776	664	powershell.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\nestingMacadamia.jpg DrawThemeIcon
2⤵
PID:1776

memory/664-54-0x000007FEFB6F1000-0x000007FEFB6F3000-memory.dmp

Filesize
8KB

Download
memory/664-55-0x000007FEF3D30000-0x000007FEF4753000-memory.dmp

Filesize
10.1MB

Download
memory/664-57-0x0000000002704000-0x0000000002707000-memory.dmp

Filesize
12KB

Download
memory/664-56-0x000007FEF31D0000-0x000007FEF3D2D000-memory.dmp

Filesize
11.4MB

Download
memory/664-58-0x000000001B700000-0x000000001B9FF000-memory.dmp

Filesize
3.0MB

Download
memory/664-59-0x000000000270B000-0x000000000272A000-memory.dmp

Filesize
124KB

Download
memory/664-61-0x0000000002704000-0x0000000002707000-memory.dmp

Filesize
12KB

Download
memory/664-62-0x000000000270B000-0x000000000272A000-memory.dmp

Filesize
124KB

Download
memory/1776-60-0x0000000000000000-mapping.dmp

Download