53eafeee2c494c3418d47a25664a414619885cc92447a735657b2ceedad71cde

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 18:56

Target

metaphysic/possessively.ps1
Size

364B
MD5

fdd112c79808f54c51315a2db79543a3
SHA1

ed4e556ee19f1066494870a2bb6c4714800dad20
SHA256

b9efb8b9e271b08de4b59d78720796e7b428a989e8d7cb05f01713ea526b86dd
SHA512

95c1215833e1490d42fd041f0f3203c0f11bd70e889d4f1017f0e9533318c1c99c7a797c463016022fc79d0b4493198311ffa1b3476a1e29968258d19085a8cf

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1760 powershell.exe
1760 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1760 powershell.exe

pid	process
1760	powershell.exe
1760	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1760	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1760 wrote to memory of 1268	1760	powershell.exe	rundll32.exe
PID 1760 wrote to memory of 1268	1760	powershell.exe	rundll32.exe
PID 1760 wrote to memory of 1268	1760	powershell.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\mercifulHaddock.txt DrawThemeIcon
2⤵
PID:1268

memory/1268-60-0x0000000000000000-mapping.dmp

Download
memory/1760-54-0x000007FEFB621000-0x000007FEFB623000-memory.dmp

Filesize
8KB

Download
memory/1760-55-0x000007FEF35E0000-0x000007FEF4003000-memory.dmp

Filesize
10.1MB

Download
memory/1760-56-0x000007FEF2A80000-0x000007FEF35DD000-memory.dmp

Filesize
11.4MB

Download
memory/1760-57-0x0000000002784000-0x0000000002787000-memory.dmp

Filesize
12KB

Download
memory/1760-58-0x000000001B7C0000-0x000000001BABF000-memory.dmp

Filesize
3.0MB

Download
memory/1760-59-0x000000000278B000-0x00000000027AA000-memory.dmp

Filesize
124KB

Download
memory/1760-62-0x000000000278B000-0x00000000027AA000-memory.dmp

Filesize
124KB

Download
memory/1760-61-0x0000000002784000-0x0000000002787000-memory.dmp

Filesize
12KB

Download