2f2389c4427f79cb94d8d4fb3650b1cf0a27c0fc8996cf9edd061aa8b74fb6c4

Analysis

max time kernel
145s
max time network
179s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
02-04-2023 17:50

Target

Oneshot/Data/Map078.ps1
Size

15KB
MD5

0858e5f0e2d7ace0d9e5837cb73fc3d5
SHA1

c7b686082ddc052f421590655f09e7e2cce40e1d
SHA256

280cef324d1807caad4afd7e441930c377d3bdb95165782f7eca03f989cae631
SHA512

eb810d2af3a47a8153a5fe4dcf64fdf01ad8788ae0fdb1cf49b2b951933c21fa8ad0e4419f2704b29a73098669fc075dc61f4065bdcab2aa53005c83e63b14aa
SSDEEP

384:chezWfvjFDCLdqVsc6eqgBzUfa/TGqTbWacCTFU:cL/y

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3848 2824 WerFault.exe powershell.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

2824 powershell.exe
2824 powershell.exe
2824 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2824 powershell.exe

pid	pid_target	process	target process
3848	2824	WerFault.exe	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2824	powershell.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2824 -s 2064
2⤵
- Program crash
PID:3848

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1648

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0gc05w20.v1l.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/2824-122-0x0000026E5A7D0000-0x0000026E5A7E0000-memory.dmp

Filesize
64KB

Download
memory/2824-123-0x0000026E5A7D0000-0x0000026E5A7E0000-memory.dmp

Filesize
64KB

Download
memory/2824-124-0x0000026E74B90000-0x0000026E74C12000-memory.dmp

Filesize
520KB

Download
memory/2824-125-0x0000026E74B10000-0x0000026E74B20000-memory.dmp

Filesize
64KB

Download
memory/2824-126-0x0000026E74B50000-0x0000026E74B72000-memory.dmp

Filesize
136KB

Download
memory/2824-127-0x0000026E74D30000-0x0000026E74E32000-memory.dmp

Filesize
1.0MB

Download
memory/2824-132-0x0000026E5A7D0000-0x0000026E5A7E0000-memory.dmp

Filesize
64KB

Download
memory/2824-133-0x0000026E5A7D0000-0x0000026E5A7E0000-memory.dmp

Filesize
64KB

Download
memory/2824-134-0x0000026E750C0000-0x0000026E75136000-memory.dmp

Filesize
472KB

Download
memory/2824-157-0x0000026E5A7D0000-0x0000026E5A7E0000-memory.dmp

Filesize
64KB

Download
memory/2824-158-0x0000026E5A7D0000-0x0000026E5A7E0000-memory.dmp

Filesize
64KB

Download