7b22dcff146ecaa431ff85960dcd872ad619603f76cad0817dbc6d3ec200c8ca

Analysis

max time kernel
152s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
01/08/2023, 21:12

Target

psss.ps1
Size

6KB
MD5

40d4654340f844a7226eb8363d9bdc4f
SHA1

c50e527a80bf984a99149738b7533aa887651e0a
SHA256

7b22dcff146ecaa431ff85960dcd872ad619603f76cad0817dbc6d3ec200c8ca
SHA512

26ab43642caa28485c094c41414f7468087dcf9ad052d3545e32ff0e2cc6abba8f6201e20ac65a9db612d3893ca61398f6df2404fee3ed27b1bafc2adc253879
SSDEEP

96:oLN9m7Du9qN6+5BPrxQhZVDXffmolG2lOOCApOCtI41RON/aORnwy:oLbm7DIqv/P1Q1D3mollOennaN/ady

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3048	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2848	3048	powershell.exe	29
PID 3048 wrote to memory of 2848	3048	powershell.exe	29
PID 3048 wrote to memory of 2848	3048	powershell.exe	29

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\psss.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\system32\findstr.exe
  "C:\Windows\system32\findstr.exe" .*.*.
  2⤵
  PID:2848

memory/3048-58-0x000000001B2A0000-0x000000001B582000-memory.dmp

Filesize
2.9MB

Download
memory/3048-59-0x00000000024D0000-0x00000000024D8000-memory.dmp

Filesize
32KB

Download
memory/3048-60-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp

Filesize
9.6MB

Download
memory/3048-61-0x00000000022B0000-0x0000000002330000-memory.dmp

Filesize
512KB

Download
memory/3048-62-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp

Filesize
9.6MB

Download
memory/3048-63-0x00000000022B0000-0x0000000002330000-memory.dmp

Filesize
512KB

Download
memory/3048-64-0x00000000022B0000-0x0000000002330000-memory.dmp

Filesize
512KB

Download
memory/3048-65-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp

Filesize
9.6MB

Download
memory/3048-66-0x00000000022B0000-0x0000000002330000-memory.dmp

Filesize
512KB

Download
memory/3048-67-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp

Filesize
9.6MB

Download