4ce24c022e799db363340739967bfe40edc4ed1d81588a86007eb16c8ec601e7

Analysis

max time kernel
44s
max time network
71s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 17:45

Target

8969122ef3485df.ps1
Size

424KB
MD5

7e17e5f94d45e854c6855f557d4c3b62
SHA1

dc1894577c77ea178a40510d676fc31e4049bce3
SHA256

d19fc72db9725c704b88f4dbf52fdc11d609d6adeedaafa8b79ca76dc7da12c2
SHA512

80f6dbc86f5825b5935d775614e531981fcd0d768092e83f6e364514ae6ec868b916d057c739f0cf8e2226aa5a495f72d1aafed1b9196a9ce5976994be38b6bd
SSDEEP

6144:cJg4cOlXYM0DPGj7fw0xB2pPBrGyMsY7iGBa5fIoYAUdfv05Xs0lHBMjMlzN0s:cu4cO+MkPGI4MpPBrCi1B+05Xll90s

Score

8^/10

Blocklisted process makes network request 3 IoCs

Processes:

powershell.exe

flow pid process

4 1032 powershell.exe
5 1032 powershell.exe
6 1032 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1032 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1032 powershell.exe

pid	process
1032	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1032	powershell.exe

memory/1032-54-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

Filesize
8KB

Download
memory/1032-55-0x000007FEF3C50000-0x000007FEF4673000-memory.dmp

Filesize
10.1MB

Download
memory/1032-56-0x000007FEF30F0000-0x000007FEF3C4D000-memory.dmp

Filesize
11.4MB

Download
memory/1032-57-0x000000001B810000-0x000000001BB0F000-memory.dmp

Filesize
3.0MB

Download
memory/1032-58-0x0000000002894000-0x0000000002897000-memory.dmp

Filesize
12KB

Download
memory/1032-59-0x000000000289B000-0x00000000028BA000-memory.dmp

Filesize
124KB

Download
memory/1032-60-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download
memory/1032-61-0x0000000002894000-0x0000000002897000-memory.dmp

Filesize
12KB

Download
memory/1032-62-0x000000000289B000-0x00000000028BA000-memory.dmp

Filesize
124KB

Download
memory/1032-63-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download
memory/1032-64-0x000000000289B000-0x00000000028BA000-memory.dmp

Filesize
124KB

Download
memory/1032-65-0x0000000002800000-0x0000000002802000-memory.dmp

Filesize
8KB

Download