3773c12491a4d8462144e592bd3a9746186ca41928b2443959c548cbccb45b37

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21-12-2023 20:44

Target

0533575076d7185ba435f3d260e8b3e4.ps1
Size

485KB
MD5

0533575076d7185ba435f3d260e8b3e4
SHA1

ab887dd690c6f1880cc1c01f44296c747b36e4b0
SHA256

3773c12491a4d8462144e592bd3a9746186ca41928b2443959c548cbccb45b37
SHA512

8e472035f8d3c7740a34db8bfffac28494c87221e3d398b93cbccb6113b01c51fd964571906ee044d61a31df167727f3238b596da9f8dcd2b032bbae4a4cdfa8
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64kigu:q3Ru

Score

1^/10

Suspicious behavior: EnumeratesProcesses 11 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2836	2232	powershell.exe	29
PID 2232 wrote to memory of 2836	2232	powershell.exe	29
PID 2232 wrote to memory of 2836	2232	powershell.exe	29
PID 2232 wrote to memory of 2836	2232	powershell.exe	29
PID 2232 wrote to memory of 2844	2232	powershell.exe	30
PID 2232 wrote to memory of 2844	2232	powershell.exe	30
PID 2232 wrote to memory of 2844	2232	powershell.exe	30
PID 2232 wrote to memory of 2844	2232	powershell.exe	30
PID 2232 wrote to memory of 2868	2232	powershell.exe	31
PID 2232 wrote to memory of 2868	2232	powershell.exe	31
PID 2232 wrote to memory of 2868	2232	powershell.exe	31
PID 2232 wrote to memory of 2868	2232	powershell.exe	31
PID 2232 wrote to memory of 2804	2232	powershell.exe	32
PID 2232 wrote to memory of 2804	2232	powershell.exe	32
PID 2232 wrote to memory of 2804	2232	powershell.exe	32
PID 2232 wrote to memory of 2804	2232	powershell.exe	32
PID 2232 wrote to memory of 2748	2232	powershell.exe	33
PID 2232 wrote to memory of 2748	2232	powershell.exe	33
PID 2232 wrote to memory of 2748	2232	powershell.exe	33
PID 2232 wrote to memory of 2748	2232	powershell.exe	33

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\0533575076d7185ba435f3d260e8b3e4.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2844
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2748

memory/2232-4-0x000000001B2F0000-0x000000001B5D2000-memory.dmp

Filesize
2.9MB

Download
memory/2232-5-0x0000000002800000-0x0000000002808000-memory.dmp

Filesize
32KB

Download
memory/2232-6-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Filesize
9.6MB

Download
memory/2232-7-0x00000000029F0000-0x0000000002A70000-memory.dmp

Filesize
512KB

Download
memory/2232-8-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Filesize
9.6MB

Download
memory/2232-9-0x00000000029F0000-0x0000000002A70000-memory.dmp

Filesize
512KB

Download
memory/2232-10-0x00000000029F0000-0x0000000002A70000-memory.dmp

Filesize
512KB

Download
memory/2232-11-0x00000000029F0000-0x0000000002A70000-memory.dmp

Filesize
512KB

Download
memory/2232-12-0x000000001B210000-0x000000001B222000-memory.dmp

Filesize
72KB

Download
memory/2232-13-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Filesize
9.6MB

Download