35555de0fd270122c599416b793569b225601f9386d19e54aeccf93239335e1c

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-03-2023 14:33

Target

malware (2).ps1
Size

486B
MD5

b0085ae8c3b0f2e6ce52df69125f31f3
SHA1

4d9d4234ae40aa7bc48620c2efcb7855c7d7ba10
SHA256

35555de0fd270122c599416b793569b225601f9386d19e54aeccf93239335e1c
SHA512

40b1b6d3417544ddb3a7e1d4674a44c71a605edcdd3eabd4e2151a31142746eb093a446676d0f50c130b9eff1989783e5d83e65d669c20d73c941a4ae070902e

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1924	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1924	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 544	1924	powershell.exe	27
PID 1924 wrote to memory of 544	1924	powershell.exe	27
PID 1924 wrote to memory of 544	1924	powershell.exe	27

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\malware (2).ps1"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\system32\chcp.com
  "C:\Windows\system32\chcp.com" 65001
  2⤵
  PID:544

memory/1924-58-0x000000001B040000-0x000000001B322000-memory.dmp

Filesize
2.9MB

Download
memory/1924-59-0x0000000002640000-0x00000000026C0000-memory.dmp

Filesize
512KB

Download
memory/1924-60-0x0000000002640000-0x00000000026C0000-memory.dmp

Filesize
512KB

Download
memory/1924-61-0x0000000002360000-0x0000000002368000-memory.dmp

Filesize
32KB

Download
memory/1924-62-0x0000000002644000-0x0000000002647000-memory.dmp

Filesize
12KB

Download
memory/1924-63-0x000000000264B000-0x0000000002682000-memory.dmp

Filesize
220KB

Download