faacab70e93599e4bd87bb16be40e6aab5034e913986aa11aa6392f3c4e7af6f

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 20:28

Target

fix/archery.ps1
Size

379B
MD5

b29c2088d8e08cdbcf8a6986f30157b7
SHA1

f8463b7e9f83c3e77234e7fe066855a752de713a
SHA256

f3624087293ba86bbb2c2f619f012a8287c1b4b0aeead16ede208fa88fbdc6f5
SHA512

039c024ab4cd0938fc18b365ff7b9e38dd40cd474d3f76ced69f1079a6d3e6335508d93a4d79ef444d59fc4036be8c1bbb93e8cf414c14ab260d1d8b2dbfd0bd

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1688 powershell.exe
1688 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1688 powershell.exe

pid	process
1688	powershell.exe
1688	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1688	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1688 wrote to memory of 1656	1688	powershell.exe	rundll32.exe
PID 1688 wrote to memory of 1656	1688	powershell.exe	rundll32.exe
PID 1688 wrote to memory of 1656	1688	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\fix\archery.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\users\public\recollectionFelicity.jpg DrawThemeIcon
  2⤵
  PID:1656

memory/1656-60-0x0000000000000000-mapping.dmp

Download
memory/1688-54-0x000007FEFB731000-0x000007FEFB733000-memory.dmp

Filesize
8KB

Download
memory/1688-55-0x000007FEF3AA0000-0x000007FEF44C3000-memory.dmp

Filesize
10.1MB

Download
memory/1688-56-0x0000000002594000-0x0000000002597000-memory.dmp

Filesize
12KB

Download
memory/1688-57-0x000007FEF2F40000-0x000007FEF3A9D000-memory.dmp

Filesize
11.4MB

Download
memory/1688-58-0x000000001B820000-0x000000001BB1F000-memory.dmp

Filesize
3.0MB

Download
memory/1688-59-0x000000000259B000-0x00000000025BA000-memory.dmp

Filesize
124KB

Download
memory/1688-61-0x0000000002594000-0x0000000002597000-memory.dmp

Filesize
12KB

Download
memory/1688-62-0x000000000259B000-0x00000000025BA000-memory.dmp

Filesize
124KB

Download