fdfc54fbb4bbccd4470385a3d75674eb977139c6279af9bd6000d065fd0d575b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 12:44

Target

8c25a3a8169f7372c33ccb7233d269a5.ps1
Size

485KB
MD5

8c25a3a8169f7372c33ccb7233d269a5
SHA1

830adc70f65a341b113f1d651017b751cdc55ac4
SHA256

fdfc54fbb4bbccd4470385a3d75674eb977139c6279af9bd6000d065fd0d575b
SHA512

3573c8bc001d94c8f256f55979852c4a35ef1a7dcbe8a93171981226be63aa21521101ba6abb29d83ad4c7f1dd579d27cf9b21d43853267060f6562b1deb3d86
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64aigu:q33u

Score

1^/10

Suspicious behavior: EnumeratesProcesses 11 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2088	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 632	2088	powershell.exe	29
PID 2088 wrote to memory of 632	2088	powershell.exe	29
PID 2088 wrote to memory of 632	2088	powershell.exe	29
PID 2088 wrote to memory of 632	2088	powershell.exe	29
PID 2088 wrote to memory of 1748	2088	powershell.exe	33
PID 2088 wrote to memory of 1748	2088	powershell.exe	33
PID 2088 wrote to memory of 1748	2088	powershell.exe	33
PID 2088 wrote to memory of 1748	2088	powershell.exe	33
PID 2088 wrote to memory of 852	2088	powershell.exe	32
PID 2088 wrote to memory of 852	2088	powershell.exe	32
PID 2088 wrote to memory of 852	2088	powershell.exe	32
PID 2088 wrote to memory of 852	2088	powershell.exe	32
PID 2088 wrote to memory of 2568	2088	powershell.exe	31
PID 2088 wrote to memory of 2568	2088	powershell.exe	31
PID 2088 wrote to memory of 2568	2088	powershell.exe	31
PID 2088 wrote to memory of 2568	2088	powershell.exe	31
PID 2088 wrote to memory of 2604	2088	powershell.exe	30
PID 2088 wrote to memory of 2604	2088	powershell.exe	30
PID 2088 wrote to memory of 2604	2088	powershell.exe	30
PID 2088 wrote to memory of 2604	2088	powershell.exe	30

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\8c25a3a8169f7372c33ccb7233d269a5.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:632
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2604
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:1748

memory/2088-4-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2088-5-0x0000000002320000-0x0000000002328000-memory.dmp

Filesize
32KB

Download
memory/2088-6-0x000007FEF59B0000-0x000007FEF634D000-memory.dmp

Filesize
9.6MB

Download
memory/2088-7-0x0000000002D20000-0x0000000002DA0000-memory.dmp

Filesize
512KB

Download
memory/2088-8-0x000007FEF59B0000-0x000007FEF634D000-memory.dmp

Filesize
9.6MB

Download
memory/2088-9-0x0000000002D20000-0x0000000002DA0000-memory.dmp

Filesize
512KB

Download
memory/2088-10-0x0000000002D20000-0x0000000002DA0000-memory.dmp

Filesize
512KB

Download
memory/2088-11-0x0000000002D20000-0x0000000002DA0000-memory.dmp

Filesize
512KB

Download
memory/2088-12-0x0000000002AF0000-0x0000000002B02000-memory.dmp

Filesize
72KB

Download
memory/2088-13-0x000007FEF59B0000-0x000007FEF634D000-memory.dmp

Filesize
9.6MB

Download