124cc3d3c5991ea8a73301ce2f9f8d775bc6920db4fd51b1ea4c87ecd89edb56

Analysis

max time kernel
31s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 19:58

Target

fix/annually.ps1
Size

375B
MD5

4805c032d5d49c79b0a1b3ad6804fc28
SHA1

1138e64e4e295ba987c27fbff544c8469f9d8cb1
SHA256

ac83785a297e3682699e36b2de839acc4228953cf323312d8af8a10016d517a0
SHA512

2ea3780ef0eeede995155bfe2b7741e16d75081546725964a36ff85fd95efbd2236d5aa7bb308cb520cf63afe74f8f1cf189e4bd20c21f8ec6c060d4d0982d3c

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1112 powershell.exe
1112 powershell.exe
1112 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1112 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1112	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1112 wrote to memory of 1784	1112	powershell.exe	rundll32.exe
PID 1112 wrote to memory of 1784	1112	powershell.exe	rundll32.exe
PID 1112 wrote to memory of 1784	1112	powershell.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\compressibleEdge.jpg DrawThemeIcon
2⤵
PID:1784

memory/1112-54-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp

Filesize
8KB

Download
memory/1112-55-0x000007FEF4280000-0x000007FEF4CA3000-memory.dmp

Filesize
10.1MB

Download
memory/1112-57-0x00000000028E4000-0x00000000028E7000-memory.dmp

Filesize
12KB

Download
memory/1112-56-0x000007FEF3720000-0x000007FEF427D000-memory.dmp

Filesize
11.4MB

Download
memory/1112-58-0x000000001B820000-0x000000001BB1F000-memory.dmp

Filesize
3.0MB

Download
memory/1112-59-0x00000000028EB000-0x000000000290A000-memory.dmp

Filesize
124KB

Download
memory/1112-61-0x00000000028E4000-0x00000000028E7000-memory.dmp

Filesize
12KB

Download
memory/1112-62-0x00000000028EB000-0x000000000290A000-memory.dmp

Filesize
124KB

Download
memory/1784-60-0x0000000000000000-mapping.dmp

Download