0d20d075cf8e97e778f907255f5d6fe18de6f7d0da42c7bc2af700a2f69b72b1

Analysis

max time kernel
27s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/01/2023, 17:32

Target

data/scripts/Energy/Ultimate Performance mode.ps1
Size

911B
MD5

b6c26c787299fee4289b21a390eff26f
SHA1

0edf2737568c929dbf8b3e9aff69b4570b475175
SHA256

c92324f1a31e4bd710fef9ef4b54bcef7593dbd68f03214da79a59a1f327f037
SHA512

c1d71d8d884bc48196bd28b44adc53a98d738509e09d0306389d124bf1a1165d36b2e9758d5571e2175cf5aa0c93819e0006a857a0eb03135df4e845d38cb3bd

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1628	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeShutdownPrivilege	1172	powercfg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1172	1628	powershell.exe	29
PID 1628 wrote to memory of 1172	1628	powershell.exe	29
PID 1628 wrote to memory of 1172	1628	powershell.exe	29

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\data\scripts\Energy\Ultimate Performance mode.ps1"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1172

memory/1628-54-0x000007FEFB851000-0x000007FEFB853000-memory.dmp

Filesize
8KB

Download
memory/1628-55-0x000007FEF2E80000-0x000007FEF38A3000-memory.dmp

Filesize
10.1MB

Download
memory/1628-56-0x000007FEF2320000-0x000007FEF2E7D000-memory.dmp

Filesize
11.4MB

Download
memory/1628-57-0x000000001B760000-0x000000001BA5F000-memory.dmp

Filesize
3.0MB

Download
memory/1628-58-0x0000000002914000-0x0000000002917000-memory.dmp

Filesize
12KB

Download
memory/1628-59-0x000007FEED010000-0x000007FEEE0A6000-memory.dmp

Filesize
16.6MB

Download
memory/1628-60-0x000000000291B000-0x000000000293A000-memory.dmp

Filesize
124KB

Download
memory/1628-63-0x0000000002914000-0x0000000002917000-memory.dmp

Filesize
12KB

Download
memory/1628-62-0x000000000291B000-0x000000000293A000-memory.dmp

Filesize
124KB

Download