f2ea340a6eaa561e9fa571b190944ba053012f400c0bd82af7ce3d20507e2e2a

Analysis

max time kernel
42s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 17:24

Target

fix/bluffer.ps1
Size

371B
MD5

125800de40408e58ec84a8605554e7b0
SHA1

8bd9500db14f4c9f1f4b77ed1b295f63b5ff28ec
SHA256

73525b8463cea42ff3f528e718644d79b92c614976ef4d46d8a84b333c35eba7
SHA512

5c9e34964d406995e714ae234f06e44b7a69fdc044cd9b20d396aa29af6ad792cedfa4f564babd28b4a191cd54dc5f054526b01f010ebf9249038dda67238b1e

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1808 powershell.exe
1808 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1808 powershell.exe

pid	process
1808	powershell.exe
1808	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1808	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1808 wrote to memory of 1864	1808	powershell.exe	rundll32.exe
PID 1808 wrote to memory of 1864	1808	powershell.exe	rundll32.exe
PID 1808 wrote to memory of 1864	1808	powershell.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\crippledDome.jpg DrawThemeIcon
2⤵
PID:1864

memory/1808-54-0x000007FEFC001000-0x000007FEFC003000-memory.dmp

Filesize
8KB

Download
memory/1808-55-0x000007FEF37E0000-0x000007FEF4203000-memory.dmp

Filesize
10.1MB

Download
memory/1808-56-0x000007FEF2C80000-0x000007FEF37DD000-memory.dmp

Filesize
11.4MB

Download
memory/1808-57-0x0000000002564000-0x0000000002567000-memory.dmp

Filesize
12KB

Download
memory/1808-58-0x000000001B810000-0x000000001BB0F000-memory.dmp

Filesize
3.0MB

Download
memory/1808-60-0x0000000002564000-0x0000000002567000-memory.dmp

Filesize
12KB

Download
memory/1808-61-0x000000000256B000-0x000000000258A000-memory.dmp

Filesize
124KB

Download
memory/1864-59-0x0000000000000000-mapping.dmp

Download