1a3bfa106f73b81714ba7088aa3361192e092efb9b44dd249be84ab19ca08642

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16/08/2023, 20:50

Target

file.ps1
Size

19B
MD5

9f52a1e80abf80b53104c4990807b82a
SHA1

a46efa43abe45c11e732cd12f171ab8da27b392d
SHA256

1a3bfa106f73b81714ba7088aa3361192e092efb9b44dd249be84ab19ca08642
SHA512

308ada3f7f8c0616e2f08a6119c4b4601406b5393162aa3ce5145ead5faa661d3d124ab5a348c4cc2aa7d3000223d828cd534243a4171c6b550029eac8f81a88

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2676	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2580	2676	powershell.exe	29
PID 2676 wrote to memory of 2580	2676	powershell.exe	29
PID 2676 wrote to memory of 2580	2676	powershell.exe	29

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\system32\shutdown.exe
  "C:\Windows\system32\shutdown.exe" -P now
  2⤵
  PID:2580

memory/2676-58-0x000000001B220000-0x000000001B502000-memory.dmp

Filesize
2.9MB

Download
memory/2676-59-0x0000000001F30000-0x0000000001F38000-memory.dmp

Filesize
32KB

Download
memory/2676-60-0x000007FEF5800000-0x000007FEF619D000-memory.dmp

Filesize
9.6MB

Download
memory/2676-65-0x0000000002830000-0x00000000028B0000-memory.dmp

Filesize
512KB

Download
memory/2676-64-0x0000000002830000-0x00000000028B0000-memory.dmp

Filesize
512KB

Download
memory/2676-63-0x0000000002830000-0x00000000028B0000-memory.dmp

Filesize
512KB

Download
memory/2676-62-0x0000000002830000-0x00000000028B0000-memory.dmp

Filesize
512KB

Download
memory/2676-61-0x000007FEF5800000-0x000007FEF619D000-memory.dmp

Filesize
9.6MB

Download
memory/2676-66-0x000007FEF5800000-0x000007FEF619D000-memory.dmp

Filesize
9.6MB

Download