0b39b5ad19dee91667016b3b3534416bd6e5a20bba3edcb4aab80f43bec0d4d9

Resubmissions

09-12-2022 21:27

07-12-2022 11:05

max time kernel
44s
max time network
89s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 11:05

Target

metaphysic/clumped.ps1
Size

370B
MD5

5c6752386f0d0998e473c07477426a5e
SHA1

f12c4cd2257af6b248571bf390784ada9cca3e4b
SHA256

9b626bf28a18833d5a1d9a67a8e884111838574d7e69d2688de3a11fcd514079
SHA512

d372a20e56dbe572b2893a4c480f7ef2218c2462b4b9bcda8d157eaa76464b4deebe2c1b46d1026fc8e2587b947074246752b4e383143ad7d125284d92b4bc25

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1724 powershell.exe
1724 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1724 powershell.exe

pid	process
1724	powershell.exe
1724	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1724	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1724 wrote to memory of 1100	1724	powershell.exe	rundll32.exe
PID 1724 wrote to memory of 1100	1724	powershell.exe	rundll32.exe
PID 1724 wrote to memory of 1100	1724	powershell.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\spikingUnintelligible.txt DrawThemeIcon
2⤵
PID:1100

memory/1100-58-0x0000000000000000-mapping.dmp

Download
memory/1724-54-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Filesize
8KB

Download
memory/1724-55-0x000007FEF3D90000-0x000007FEF47B3000-memory.dmp

Filesize
10.1MB

Download
memory/1724-56-0x000007FEF3230000-0x000007FEF3D8D000-memory.dmp

Filesize
11.4MB

Download
memory/1724-57-0x0000000002514000-0x0000000002517000-memory.dmp

Filesize
12KB

Download
memory/1724-60-0x000000000251B000-0x000000000253A000-memory.dmp

Filesize
124KB

Download
memory/1724-59-0x0000000002514000-0x0000000002517000-memory.dmp

Filesize
12KB

Download