a76a51cba975464b208e05477e673e7ee026979baefc09638e9474e3f38c715c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 07:12

Target

77e2b04565e2fa5129b062b860253c8d.ps1
Size

485KB
MD5

77e2b04565e2fa5129b062b860253c8d
SHA1

11f8ec2444d78ff88d2a7c9cbb1ee188ef85d004
SHA256

a76a51cba975464b208e05477e673e7ee026979baefc09638e9474e3f38c715c
SHA512

ee0c8ac9e48b8cc53eeac3ce08ba876b330b2cb6f2506bb3d75b0e443292662270af767324aa091a9d7bad0b42d74e5924f608b521a19ed608dde89e12111fdb
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64tigu:q3Ou

Score

1^/10

Suspicious behavior: EnumeratesProcesses 11 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2560	2552	powershell.exe	29
PID 2552 wrote to memory of 2560	2552	powershell.exe	29
PID 2552 wrote to memory of 2560	2552	powershell.exe	29
PID 2552 wrote to memory of 2560	2552	powershell.exe	29
PID 2552 wrote to memory of 2820	2552	powershell.exe	33
PID 2552 wrote to memory of 2820	2552	powershell.exe	33
PID 2552 wrote to memory of 2820	2552	powershell.exe	33
PID 2552 wrote to memory of 2820	2552	powershell.exe	33
PID 2552 wrote to memory of 2608	2552	powershell.exe	32
PID 2552 wrote to memory of 2608	2552	powershell.exe	32
PID 2552 wrote to memory of 2608	2552	powershell.exe	32
PID 2552 wrote to memory of 2608	2552	powershell.exe	32
PID 2552 wrote to memory of 2576	2552	powershell.exe	31
PID 2552 wrote to memory of 2576	2552	powershell.exe	31
PID 2552 wrote to memory of 2576	2552	powershell.exe	31
PID 2552 wrote to memory of 2576	2552	powershell.exe	31
PID 2552 wrote to memory of 2624	2552	powershell.exe	30
PID 2552 wrote to memory of 2624	2552	powershell.exe	30
PID 2552 wrote to memory of 2624	2552	powershell.exe	30
PID 2552 wrote to memory of 2624	2552	powershell.exe	30

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\77e2b04565e2fa5129b062b860253c8d.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2624
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2820

memory/2552-4-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2552-6-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmp

Filesize
9.6MB

Download
memory/2552-7-0x0000000002850000-0x00000000028D0000-memory.dmp

Filesize
512KB

Download
memory/2552-5-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/2552-8-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmp

Filesize
9.6MB

Download
memory/2552-10-0x0000000002850000-0x00000000028D0000-memory.dmp

Filesize
512KB

Download
memory/2552-9-0x0000000002850000-0x00000000028D0000-memory.dmp

Filesize
512KB

Download
memory/2552-11-0x0000000002A00000-0x0000000002A12000-memory.dmp

Filesize
72KB

Download
memory/2552-12-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmp

Filesize
9.6MB

Download