243ef842a374b5124aa91d545bd87ac47f712fdf7af1f65f0c478c7936c08610

Resubmissions

24/11/2023, 19:41

23/11/2023, 19:10

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
24/11/2023, 19:41

Target

code.ps1
Size

36B
MD5

5adaa8945d570aaa00cc1c56f29d3cdb
SHA1

fe0f60644a1a564d151d4139dc9d886c11251636
SHA256

243ef842a374b5124aa91d545bd87ac47f712fdf7af1f65f0c478c7936c08610
SHA512

2d8a6f26fed21f37bac86b97efecc0d4e0baf9dba7dfa0cc458b882fd7912855ff82e3992e3a9881349644a48c27a213dc862298f3a0ee7244a748113cd9e5c4

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2924	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2492	dw20.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2924	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2492	2924	powershell.exe	29
PID 2924 wrote to memory of 2492	2924	powershell.exe	29
PID 2924 wrote to memory of 2492	2924	powershell.exe	29

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\code.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 768
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2492

memory/2492-10-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/2924-4-0x000000001B4A0000-0x000000001B782000-memory.dmp

Filesize
2.9MB

Download
memory/2924-5-0x000007FEF5580000-0x000007FEF5F1D000-memory.dmp

Filesize
9.6MB

Download
memory/2924-6-0x0000000002480000-0x0000000002488000-memory.dmp

Filesize
32KB

Download
memory/2924-7-0x000007FEF5580000-0x000007FEF5F1D000-memory.dmp

Filesize
9.6MB

Download
memory/2924-8-0x000007FEF5580000-0x000007FEF5F1D000-memory.dmp

Filesize
9.6MB

Download
memory/2924-9-0x0000000002A20000-0x0000000002AA0000-memory.dmp

Filesize
512KB

Download
memory/2924-11-0x0000000002A20000-0x0000000002AA0000-memory.dmp

Filesize
512KB

Download
memory/2924-12-0x0000000002A20000-0x0000000002AA0000-memory.dmp

Filesize
512KB

Download
memory/2924-13-0x000007FEF5580000-0x000007FEF5F1D000-memory.dmp

Filesize
9.6MB

Download