ad86961a4df9ed275fa5cbf709b6d394f992a531cf0762ff1de73ab832f91c5a

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 13:11

Target

9b2f171a482bb7a217bc5831a7dcbf1c.ps1
Size

485KB
MD5

9b2f171a482bb7a217bc5831a7dcbf1c
SHA1

1ee718a4449be57fd88455a2de6150d6506057df
SHA256

ad86961a4df9ed275fa5cbf709b6d394f992a531cf0762ff1de73ab832f91c5a
SHA512

6427bd1d42780b24a8b49f487d94e986cb84dfe4abd7361876520bf6d779f2aff3e667edfb577f4315d2804f23d44569c368f18b5ccb06a62beb71cc8061d6c1
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64figu:q3wu

Score

1^/10

Suspicious behavior: EnumeratesProcesses 11 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2828	3004	powershell.exe	29
PID 3004 wrote to memory of 2828	3004	powershell.exe	29
PID 3004 wrote to memory of 2828	3004	powershell.exe	29
PID 3004 wrote to memory of 2828	3004	powershell.exe	29
PID 3004 wrote to memory of 2668	3004	powershell.exe	30
PID 3004 wrote to memory of 2668	3004	powershell.exe	30
PID 3004 wrote to memory of 2668	3004	powershell.exe	30
PID 3004 wrote to memory of 2668	3004	powershell.exe	30
PID 3004 wrote to memory of 2164	3004	powershell.exe	31
PID 3004 wrote to memory of 2164	3004	powershell.exe	31
PID 3004 wrote to memory of 2164	3004	powershell.exe	31
PID 3004 wrote to memory of 2164	3004	powershell.exe	31
PID 3004 wrote to memory of 2068	3004	powershell.exe	32
PID 3004 wrote to memory of 2068	3004	powershell.exe	32
PID 3004 wrote to memory of 2068	3004	powershell.exe	32
PID 3004 wrote to memory of 2068	3004	powershell.exe	32
PID 3004 wrote to memory of 2064	3004	powershell.exe	33
PID 3004 wrote to memory of 2064	3004	powershell.exe	33
PID 3004 wrote to memory of 2064	3004	powershell.exe	33
PID 3004 wrote to memory of 2064	3004	powershell.exe	33

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\9b2f171a482bb7a217bc5831a7dcbf1c.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2668
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2164
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2064

memory/3004-4-0x000000001B2D0000-0x000000001B5B2000-memory.dmp

Filesize
2.9MB

Download
memory/3004-5-0x0000000002710000-0x0000000002718000-memory.dmp

Filesize
32KB

Download
memory/3004-6-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download
memory/3004-7-0x0000000002870000-0x00000000028F0000-memory.dmp

Filesize
512KB

Download
memory/3004-8-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download
memory/3004-9-0x0000000002870000-0x00000000028F0000-memory.dmp

Filesize
512KB

Download
memory/3004-10-0x0000000002870000-0x00000000028F0000-memory.dmp

Filesize
512KB

Download
memory/3004-11-0x000000001B210000-0x000000001B222000-memory.dmp

Filesize
72KB

Download
memory/3004-12-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download