6fba08a0ddf1d46e3c76963c27a8c624c25cd1c08f69986a9d101b7cf13257ac

Analysis

max time kernel
151s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 22:39

Target

8969122ef3485df.ps1
Size

424KB
MD5

7e17e5f94d45e854c6855f557d4c3b62
SHA1

dc1894577c77ea178a40510d676fc31e4049bce3
SHA256

d19fc72db9725c704b88f4dbf52fdc11d609d6adeedaafa8b79ca76dc7da12c2
SHA512

80f6dbc86f5825b5935d775614e531981fcd0d768092e83f6e364514ae6ec868b916d057c739f0cf8e2226aa5a495f72d1aafed1b9196a9ce5976994be38b6bd
SSDEEP

6144:cJg4cOlXYM0DPGj7fw0xB2pPBrGyMsY7iGBa5fIoYAUdfv05Xs0lHBMjMlzN0s:cu4cO+MkPGI4MpPBrCi1B+05Xll90s

Score

8^/10

Blocklisted process makes network request 5 IoCs

Processes:

powershell.exe

flow pid process

29 1460 powershell.exe
35 1460 powershell.exe
52 1460 powershell.exe
61 1460 powershell.exe
66 1460 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1460 powershell.exe
1460 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1460 powershell.exe

pid	process
1460	powershell.exe
1460	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1460	powershell.exe

memory/1460-132-0x0000018370160000-0x0000018370182000-memory.dmp

Filesize
136KB

Download
memory/1460-133-0x00007FF8A7010000-0x00007FF8A7AD1000-memory.dmp

Filesize
10.8MB

Download
memory/1460-134-0x0000018370E20000-0x0000018370E60000-memory.dmp

Filesize
256KB

Download
memory/1460-135-0x00007FF8A7010000-0x00007FF8A7AD1000-memory.dmp

Filesize
10.8MB

Download
memory/1460-136-0x0000018370E20000-0x0000018370E60000-memory.dmp

Filesize
256KB

Download