90b03dca375867f8289905c796db9860a32649e42ef75a0a77fd3bb11c7daa4a

Analysis

max time kernel
86s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2023 12:41

Target

Y1iemtEh.ps1
Size

702B
MD5

b9e5bf93d52ab53919df3ab5570b6f71
SHA1

96c7c52809e37cf157d5fdbc93f403286aa60dca
SHA256

90b03dca375867f8289905c796db9860a32649e42ef75a0a77fd3bb11c7daa4a
SHA512

4f43bf10ff614e932587aecd1f1290a045e2cdd0dd474e4edb8c1100b6d94569f8ce5b90a7ae3628737e22f8aedfd011a284ef8bc31b519ec8ec278f480f04ff

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3880	powershell.exe
3880	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3880	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 3828	3880	powershell.exe	84
PID 3880 wrote to memory of 3828	3880	powershell.exe	84

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Y1iemtEh.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" interface set interface WLAN disabled
  2⤵
  PID:3828

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rhkl3igg.abb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3880-141-0x0000029E78DA0000-0x0000029E78DC2000-memory.dmp

Filesize
136KB

Download
memory/3880-143-0x0000029E78DD0000-0x0000029E78DE0000-memory.dmp

Filesize
64KB

Download
memory/3880-144-0x0000029E78DD0000-0x0000029E78DE0000-memory.dmp

Filesize
64KB

Download
memory/3880-146-0x0000029E7B6A0000-0x0000029E7B6F0000-memory.dmp

Filesize
320KB

Download
memory/3880-149-0x0000029E78DD0000-0x0000029E78DE0000-memory.dmp

Filesize
64KB

Download