ebb3eb34385b4a892410989d1133ed0cdff8417534e2d5c8407b95923a0b35b4

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 05:01

Target

6cb56ad248abbad6b57ae9b444e05680.ps1
Size

485KB
MD5

6cb56ad248abbad6b57ae9b444e05680
SHA1

4b877bee7ec22b493bfead901ccb6ea433cb232b
SHA256

ebb3eb34385b4a892410989d1133ed0cdff8417534e2d5c8407b95923a0b35b4
SHA512

1d25eeabdc288ef0108e4307fa30815c261e6b4997f3dab5687520a738818203dc129c8eeecf03ae5ebe31209f628b762e1b997f00a72e47df76bde78a707fbc
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64cigu:q3pu

Score

1^/10

Suspicious behavior: EnumeratesProcesses 11 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2164	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2832	2164	powershell.exe	29
PID 2164 wrote to memory of 2832	2164	powershell.exe	29
PID 2164 wrote to memory of 2832	2164	powershell.exe	29
PID 2164 wrote to memory of 2832	2164	powershell.exe	29
PID 2164 wrote to memory of 2852	2164	powershell.exe	33
PID 2164 wrote to memory of 2852	2164	powershell.exe	33
PID 2164 wrote to memory of 2852	2164	powershell.exe	33
PID 2164 wrote to memory of 2852	2164	powershell.exe	33
PID 2164 wrote to memory of 2884	2164	powershell.exe	30
PID 2164 wrote to memory of 2884	2164	powershell.exe	30
PID 2164 wrote to memory of 2884	2164	powershell.exe	30
PID 2164 wrote to memory of 2884	2164	powershell.exe	30
PID 2164 wrote to memory of 2824	2164	powershell.exe	32
PID 2164 wrote to memory of 2824	2164	powershell.exe	32
PID 2164 wrote to memory of 2824	2164	powershell.exe	32
PID 2164 wrote to memory of 2824	2164	powershell.exe	32
PID 2164 wrote to memory of 2668	2164	powershell.exe	31
PID 2164 wrote to memory of 2668	2164	powershell.exe	31
PID 2164 wrote to memory of 2668	2164	powershell.exe	31
PID 2164 wrote to memory of 2668	2164	powershell.exe	31

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\6cb56ad248abbad6b57ae9b444e05680.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2668
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2852

memory/2164-4-0x000000001B290000-0x000000001B572000-memory.dmp

Filesize
2.9MB

Download
memory/2164-5-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/2164-6-0x000007FEF5D10000-0x000007FEF66AD000-memory.dmp

Filesize
9.6MB

Download
memory/2164-7-0x0000000002A10000-0x0000000002A90000-memory.dmp

Filesize
512KB

Download
memory/2164-8-0x000007FEF5D10000-0x000007FEF66AD000-memory.dmp

Filesize
9.6MB

Download
memory/2164-9-0x0000000002A10000-0x0000000002A90000-memory.dmp

Filesize
512KB

Download
memory/2164-10-0x0000000002A10000-0x0000000002A90000-memory.dmp

Filesize
512KB

Download
memory/2164-11-0x0000000002A10000-0x0000000002A90000-memory.dmp

Filesize
512KB

Download
memory/2164-12-0x0000000002770000-0x0000000002782000-memory.dmp

Filesize
72KB

Download
memory/2164-13-0x000007FEF5D10000-0x000007FEF66AD000-memory.dmp

Filesize
9.6MB

Download