2f49265797c7b7452ff754a178995629fbbe1a371873f505dae15ccfe218b170

Analysis

max time kernel
279s
max time network
421s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 17:32

Target

teased/streetcar.ps1
Size

360B
MD5

8b1705dace1204fca00b08d30c674986
SHA1

c2671acb6149ea7525fa1360d167aabd249671d7
SHA256

af90b3709a27e3f1600cf587fcf839c7a01ccd970c4ede68d0ae5dab493f49fa
SHA512

4503e5675c53aaa32559e1ceac3f9ee7be17a020ffdff2ef54f699db3ba5334ee20406060bf4082be3df399b6f0470d7db6e4049fa896e5b590b587f540b5442

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1536 powershell.exe
1536 powershell.exe
1536 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1536 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1536	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1536 wrote to memory of 900	1536	powershell.exe	rundll32.exe
PID 1536 wrote to memory of 900	1536	powershell.exe	rundll32.exe
PID 1536 wrote to memory of 900	1536	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\teased\streetcar.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\users\public\splatterSwivels.txt DrawThemeIcon
  2⤵
  PID:900

memory/900-60-0x0000000000000000-mapping.dmp

Download
memory/1536-54-0x000007FEFB641000-0x000007FEFB643000-memory.dmp

Filesize
8KB

Download
memory/1536-55-0x000007FEF3BD0000-0x000007FEF45F3000-memory.dmp

Filesize
10.1MB

Download
memory/1536-57-0x00000000024D4000-0x00000000024D7000-memory.dmp

Filesize
12KB

Download
memory/1536-56-0x000007FEF3070000-0x000007FEF3BCD000-memory.dmp

Filesize
11.4MB

Download
memory/1536-58-0x00000000024DB000-0x00000000024FA000-memory.dmp

Filesize
124KB

Download
memory/1536-59-0x00000000024D4000-0x00000000024D7000-memory.dmp

Filesize
12KB

Download
memory/1536-62-0x00000000024DB000-0x00000000024FA000-memory.dmp

Filesize
124KB

Download
memory/1536-61-0x00000000024D4000-0x00000000024D7000-memory.dmp

Filesize
12KB

Download