4e4ef37cbbe04766712cd6a9dd1985f718f7dd82fecf00ade30a018ad2146c7a

Analysis

max time kernel
134s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 17:54

Target

metaphysic/possessively.ps1
Size

364B
MD5

fdd112c79808f54c51315a2db79543a3
SHA1

ed4e556ee19f1066494870a2bb6c4714800dad20
SHA256

b9efb8b9e271b08de4b59d78720796e7b428a989e8d7cb05f01713ea526b86dd
SHA512

95c1215833e1490d42fd041f0f3203c0f11bd70e889d4f1017f0e9533318c1c99c7a797c463016022fc79d0b4493198311ffa1b3476a1e29968258d19085a8cf

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1336 powershell.exe
1336 powershell.exe
1336 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1336 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1336	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1336 wrote to memory of 572	1336	powershell.exe	rundll32.exe
PID 1336 wrote to memory of 572	1336	powershell.exe	rundll32.exe
PID 1336 wrote to memory of 572	1336	powershell.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\mercifulHaddock.txt DrawThemeIcon
2⤵
PID:572

memory/572-60-0x0000000000000000-mapping.dmp

Download
memory/1336-54-0x000007FEFC241000-0x000007FEFC243000-memory.dmp

Filesize
8KB

Download
memory/1336-55-0x000007FEF3C30000-0x000007FEF4653000-memory.dmp

Filesize
10.1MB

Download
memory/1336-57-0x00000000024E4000-0x00000000024E7000-memory.dmp

Filesize
12KB

Download
memory/1336-56-0x000007FEF2E30000-0x000007FEF398D000-memory.dmp

Filesize
11.4MB

Download
memory/1336-58-0x00000000024EB000-0x000000000250A000-memory.dmp

Filesize
124KB

Download
memory/1336-59-0x00000000024E4000-0x00000000024E7000-memory.dmp

Filesize
12KB

Download
memory/1336-61-0x00000000024E4000-0x00000000024E7000-memory.dmp

Filesize
12KB

Download
memory/1336-62-0x00000000024EB000-0x000000000250A000-memory.dmp

Filesize
124KB

Download