eeda820f8ee27fc483d338b59a5122e369c1749f0be8c1b1cd2276588471a175

Resubmissions

09-12-2022 21:26

01-12-2022 07:02

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 07:02

Target

teased/brainwaves.ps1
Size

366B
MD5

d999bce28a38621792df566ed981778a
SHA1

44e4c83d6a67fe60e4458f6e52a9bed7f1ef221a
SHA256

2401544d6ef74e83d65dae84694e0ac53e48301821507b1327e9a143bb4d1134
SHA512

0994f76e5d6db3a8ed1a03e865d6552da260e5ccbde6d4e685c42ff4222adeb80742adb6856e7b90294a34a991d2e48adf04dd27f6626b598e56dd25d5771ab7

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1672 powershell.exe
1672 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1672 powershell.exe

pid	process
1672	powershell.exe
1672	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1672	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1672 wrote to memory of 1716	1672	powershell.exe	rundll32.exe
PID 1672 wrote to memory of 1716	1672	powershell.exe	rundll32.exe
PID 1672 wrote to memory of 1716	1672	powershell.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\extroversionRadiantly.txt DrawThemeIcon
2⤵
PID:1716

memory/1672-54-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

Filesize
8KB

Download
memory/1672-55-0x000007FEF4260000-0x000007FEF4C83000-memory.dmp

Filesize
10.1MB

Download
memory/1672-57-0x0000000002824000-0x0000000002827000-memory.dmp

Filesize
12KB

Download
memory/1672-56-0x000007FEF3700000-0x000007FEF425D000-memory.dmp

Filesize
11.4MB

Download
memory/1672-60-0x000000000282B000-0x000000000284A000-memory.dmp

Filesize
124KB

Download
memory/1672-59-0x0000000002824000-0x0000000002827000-memory.dmp

Filesize
12KB

Download
memory/1716-58-0x0000000000000000-mapping.dmp

Download