3062280fe348069065ad95f3c4667935ea916f39f8e482cc9b274d29c2377407

Analysis

max time kernel
47s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 09:37

Target

fix/scaly.ps1
Size

375B
MD5

a3fde8e47ad557b120a7e89e46513d9b
SHA1

d222886e0e33b03b8ae84ccc4e9b33549bbde80f
SHA256

a895f778c2119af6eb5c8b209d63637db2cd80a40848c773fdb413683f96e9e8
SHA512

3be76c1f1bff8e9e0b6b029c4e0f515df7db7f494635f9706b173e867112fb94df11d27d790d84772533e70d7384fa30fbef57a7f1da2b1fe6d1a8008951ac36

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

576 powershell.exe
576 powershell.exe
576 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 576 powershell.exe

description	pid	process
Token: SeDebugPrivilege	576	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 576 wrote to memory of 1424	576	powershell.exe	rundll32.exe
PID 576 wrote to memory of 1424	576	powershell.exe	rundll32.exe
PID 576 wrote to memory of 1424	576	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\fix\scaly.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\users\public\inducteesRaveled.jpg DrawThemeIcon
  2⤵
  PID:1424

memory/576-54-0x000007FEFBAF1000-0x000007FEFBAF3000-memory.dmp

Filesize
8KB

Download
memory/576-55-0x000007FEF3970000-0x000007FEF4393000-memory.dmp

Filesize
10.1MB

Download
memory/576-56-0x000007FEF2D50000-0x000007FEF38AD000-memory.dmp

Filesize
11.4MB

Download
memory/576-57-0x0000000002984000-0x0000000002987000-memory.dmp

Filesize
12KB

Download
memory/576-58-0x000000001B760000-0x000000001BA5F000-memory.dmp

Filesize
3.0MB

Download
memory/576-60-0x0000000002984000-0x0000000002987000-memory.dmp

Filesize
12KB

Download
memory/576-61-0x000000000298B000-0x00000000029AA000-memory.dmp

Filesize
124KB

Download
memory/1424-59-0x0000000000000000-mapping.dmp

Download