0b39b5ad19dee91667016b3b3534416bd6e5a20bba3edcb4aab80f43bec0d4d9

Resubmissions

09-12-2022 21:27

07-12-2022 11:05

max time kernel
412s
max time network
416s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-12-2022 21:27

Target

metaphysic/clumped.ps1
Size

370B
MD5

5c6752386f0d0998e473c07477426a5e
SHA1

f12c4cd2257af6b248571bf390784ada9cca3e4b
SHA256

9b626bf28a18833d5a1d9a67a8e884111838574d7e69d2688de3a11fcd514079
SHA512

d372a20e56dbe572b2893a4c480f7ef2218c2462b4b9bcda8d157eaa76464b4deebe2c1b46d1026fc8e2587b947074246752b4e383143ad7d125284d92b4bc25

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1784 powershell.exe
1784 powershell.exe
1784 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1784 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1784	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1784 wrote to memory of 2008	1784	powershell.exe	rundll32.exe
PID 1784 wrote to memory of 2008	1784	powershell.exe	rundll32.exe
PID 1784 wrote to memory of 2008	1784	powershell.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\spikingUnintelligible.txt DrawThemeIcon
2⤵
PID:2008

memory/1784-54-0x000007FEFBA01000-0x000007FEFBA03000-memory.dmp

Filesize
8KB

Download
memory/1784-55-0x000007FEF3FB0000-0x000007FEF49D3000-memory.dmp

Filesize
10.1MB

Download
memory/1784-57-0x00000000027E4000-0x00000000027E7000-memory.dmp

Filesize
12KB

Download
memory/1784-56-0x000007FEF3450000-0x000007FEF3FAD000-memory.dmp

Filesize
11.4MB

Download
memory/1784-58-0x000000001B710000-0x000000001BA0F000-memory.dmp

Filesize
3.0MB

Download
memory/1784-59-0x00000000027EB000-0x000000000280A000-memory.dmp

Filesize
124KB

Download
memory/1784-61-0x00000000027E4000-0x00000000027E7000-memory.dmp

Filesize
12KB

Download
memory/1784-62-0x00000000027EB000-0x000000000280A000-memory.dmp

Filesize
124KB

Download
memory/2008-60-0x0000000000000000-mapping.dmp

Download