bb2577fdef6d5d1596b10a9b1300dfb84243a8088dda01006dd4357f89f9cc8c

max time kernel
842s
max time network
846s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 07:45

Sharing

Target

script.ps1
Size

7B
MD5

b53e9d6ee571941799a04433ef54b973
SHA1

525df30db44c421d4c9d9f4a0aa55f0b3da13405
SHA256

bb2577fdef6d5d1596b10a9b1300dfb84243a8088dda01006dd4357f89f9cc8c
SHA512

b855aa9789acf4a3927421690d3f8fda22c2b93ec61ed215e792f8eadee0d8aa053b7f09b05e1b5037cb7286fb5d5b32c9bc21312ca788fa52375089a45cfa10

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2208	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2348	2208	powershell.exe	29
PID 2208 wrote to memory of 2348	2208	powershell.exe	29
PID 2208 wrote to memory of 2348	2208	powershell.exe	29

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\System32\Wbem\WinMgmt.exe
  "C:\Windows\System32\Wbem\WinMgmt.exe"
  2⤵
  PID:2348

memory/2208-4-0x000000001B230000-0x000000001B512000-memory.dmp

Filesize
2.9MB

Download
memory/2208-5-0x0000000001ED0000-0x0000000001ED8000-memory.dmp

Filesize
32KB

Download
memory/2208-6-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2208-7-0x0000000002340000-0x00000000023C0000-memory.dmp

Filesize
512KB

Download
memory/2208-8-0x0000000002340000-0x00000000023C0000-memory.dmp

Filesize
512KB

Download
memory/2208-9-0x0000000002340000-0x00000000023C0000-memory.dmp

Filesize
512KB

Download
memory/2208-10-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2208-11-0x0000000002340000-0x00000000023C0000-memory.dmp

Filesize
512KB

Download
memory/2208-12-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download