955a262b9889fd6b20f3e8c5ccec98fa414070abda1656a1bc31b32acd4ece4a

Analysis

max time kernel
27s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 13:56

Target

fix/if.ps1
Size

374B
MD5

528849a1d12efbb9faa8ee144130d626
SHA1

dc40eb328bfd376c0b2cabbccc634694416befbc
SHA256

68e4e311de92ce56b1fb5d6a4b52d36fa77dd669048eeb04314f085f21266093
SHA512

8c6a0cb869d4f28ba49264fb8d001b8a5437026cfac4d3872dd11e67f1bb3fb1f34e17f317cc401ab8ba7836a20c77150e402b67ecc3fe8f178e9b93ac179383

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1940 powershell.exe
1940 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1940 powershell.exe

pid	process
1940	powershell.exe
1940	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1940	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1940 wrote to memory of 832	1940	powershell.exe	rundll32.exe
PID 1940 wrote to memory of 832	1940	powershell.exe	rundll32.exe
PID 1940 wrote to memory of 832	1940	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\fix\if.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\users\public\sweetensTumults.jpg DrawThemeIcon
  2⤵
  PID:832

memory/832-58-0x0000000000000000-mapping.dmp

Download
memory/1940-54-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

Filesize
8KB

Download
memory/1940-55-0x000007FEF4480000-0x000007FEF4EA3000-memory.dmp

Filesize
10.1MB

Download
memory/1940-56-0x000007FEF3920000-0x000007FEF447D000-memory.dmp

Filesize
11.4MB

Download
memory/1940-57-0x0000000002814000-0x0000000002817000-memory.dmp

Filesize
12KB

Download
memory/1940-59-0x0000000002814000-0x0000000002817000-memory.dmp

Filesize
12KB

Download
memory/1940-60-0x000000000281B000-0x000000000283A000-memory.dmp

Filesize
124KB

Download