a4020391b5400315217782b3bfeb4b5c475369bb6950548d09aafd48558edf2d

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-01-2023 21:04

Target

peseta/gratiae.ps1
Size

367B
MD5

5479e1a9617b0222d0a8f001c63fb23b
SHA1

0c5428239a418c8586d1699adafeb2bddb0f8c95
SHA256

e6f4fe47c6e08c3b995b5e69efee09a853426607d64715bb1cf215640f785d58
SHA512

7bc5e090fbabd4746c1a075ed4d7bbfbdb4e0a235ff8c1be5e8257d5daf4f3e22a3f04d25d21108446a684cc7371eea6882d3c1d855a3c12e868a2e8d01d4ffa

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1780 powershell.exe
1780 powershell.exe
1780 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1780 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1780	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1780 wrote to memory of 1500	1780	powershell.exe	rundll32.exe
PID 1780 wrote to memory of 1500	1780	powershell.exe	rundll32.exe
PID 1780 wrote to memory of 1500	1780	powershell.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\test1.txt DrawThemeIcon
2⤵
PID:1500

memory/1500-59-0x0000000000000000-mapping.dmp

Download
memory/1780-54-0x000007FEFC421000-0x000007FEFC423000-memory.dmp

Filesize
8KB

Download
memory/1780-55-0x000007FEF40A0000-0x000007FEF4AC3000-memory.dmp

Filesize
10.1MB

Download
memory/1780-56-0x000007FEF3540000-0x000007FEF409D000-memory.dmp

Filesize
11.4MB

Download
memory/1780-57-0x00000000023E4000-0x00000000023E7000-memory.dmp

Filesize
12KB

Download
memory/1780-58-0x000000001B6E0000-0x000000001B9DF000-memory.dmp

Filesize
3.0MB

Download
memory/1780-60-0x00000000023E4000-0x00000000023E7000-memory.dmp

Filesize
12KB

Download
memory/1780-61-0x00000000023EB000-0x000000000240A000-memory.dmp

Filesize
124KB

Download