ff15b7ab8f909775961c1d3cacf21e4aea1981c1e1830cf38bfd2822e8328876

Analysis

max time kernel
30s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 20:59

Target

fix/mildew.ps1
Size

381B
MD5

6c444a534181e1daae10ca86a6840e1c
SHA1

cd7c20f9abd78ee007ad214ac76fea236a551bc2
SHA256

e103f6bcd04cde81b8f42e54e15c43d324eb27928f1aeee3e60fcdece554e753
SHA512

3be7b2ecb8b74ea98de57215de9ca6a63ca8076b115e6c4af26b6f86980edd5adc0d1965592421de11efac34bf953b64bf95878b93e42b3318a03810ae66157b

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1812 powershell.exe
1812 powershell.exe
1812 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1812 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1812	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1812 wrote to memory of 1160	1812	powershell.exe	rundll32.exe
PID 1812 wrote to memory of 1160	1812	powershell.exe	rundll32.exe
PID 1812 wrote to memory of 1160	1812	powershell.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\quintuplicationDimples.jpg DrawThemeIcon
2⤵
PID:1160

memory/1160-61-0x0000000000000000-mapping.dmp

Download
memory/1812-54-0x000007FEFB881000-0x000007FEFB883000-memory.dmp

Filesize
8KB

Download
memory/1812-55-0x000007FEF3EC0000-0x000007FEF48E3000-memory.dmp

Filesize
10.1MB

Download
memory/1812-57-0x0000000002974000-0x0000000002977000-memory.dmp

Filesize
12KB

Download
memory/1812-56-0x000007FEF3360000-0x000007FEF3EBD000-memory.dmp

Filesize
11.4MB

Download
memory/1812-58-0x000000001B820000-0x000000001BB1F000-memory.dmp

Filesize
3.0MB

Download
memory/1812-59-0x0000000002974000-0x0000000002977000-memory.dmp

Filesize
12KB

Download
memory/1812-60-0x000000000297B000-0x000000000299A000-memory.dmp

Filesize
124KB

Download
memory/1812-63-0x000000000297B000-0x000000000299A000-memory.dmp

Filesize
124KB

Download
memory/1812-62-0x0000000002974000-0x0000000002977000-memory.dmp

Filesize
12KB

Download