9a784909bd9a8ec2d179087e6dc8635fa4508be4d04afbe4a4c30a4922ee6a7d

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 13:39

Target

a939544768ca68a7346baa3619bcd80a.ps1
Size

485KB
MD5

a939544768ca68a7346baa3619bcd80a
SHA1

1b2f6e5eab4277e189ad5af04d83b92ff577af91
SHA256

9a784909bd9a8ec2d179087e6dc8635fa4508be4d04afbe4a4c30a4922ee6a7d
SHA512

9ee7baa5950c17e03926e2b792757073f6f4f0e6e093dc83cc52bff77ac033d7ba4849405d5704d52118a25b9dd941346f7a0c9cb6a397fbe5a8135cdd81d07d
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64Eigu:q3hu

Score

1^/10

Suspicious behavior: EnumeratesProcesses 11 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2252	3000	powershell.exe	29
PID 3000 wrote to memory of 2252	3000	powershell.exe	29
PID 3000 wrote to memory of 2252	3000	powershell.exe	29
PID 3000 wrote to memory of 2252	3000	powershell.exe	29
PID 3000 wrote to memory of 2644	3000	powershell.exe	30
PID 3000 wrote to memory of 2644	3000	powershell.exe	30
PID 3000 wrote to memory of 2644	3000	powershell.exe	30
PID 3000 wrote to memory of 2644	3000	powershell.exe	30
PID 3000 wrote to memory of 2220	3000	powershell.exe	31
PID 3000 wrote to memory of 2220	3000	powershell.exe	31
PID 3000 wrote to memory of 2220	3000	powershell.exe	31
PID 3000 wrote to memory of 2220	3000	powershell.exe	31
PID 3000 wrote to memory of 2680	3000	powershell.exe	32
PID 3000 wrote to memory of 2680	3000	powershell.exe	32
PID 3000 wrote to memory of 2680	3000	powershell.exe	32
PID 3000 wrote to memory of 2680	3000	powershell.exe	32
PID 3000 wrote to memory of 2684	3000	powershell.exe	33
PID 3000 wrote to memory of 2684	3000	powershell.exe	33
PID 3000 wrote to memory of 2684	3000	powershell.exe	33
PID 3000 wrote to memory of 2684	3000	powershell.exe	33

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\a939544768ca68a7346baa3619bcd80a.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2220
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2684

memory/3000-4-0x000000001B2B0000-0x000000001B592000-memory.dmp

Filesize
2.9MB

Download
memory/3000-5-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/3000-6-0x000007FEF54F0000-0x000007FEF5E8D000-memory.dmp

Filesize
9.6MB

Download
memory/3000-7-0x00000000024C0000-0x0000000002540000-memory.dmp

Filesize
512KB

Download
memory/3000-8-0x000007FEF54F0000-0x000007FEF5E8D000-memory.dmp

Filesize
9.6MB

Download
memory/3000-9-0x00000000024C0000-0x0000000002540000-memory.dmp

Filesize
512KB

Download
memory/3000-10-0x00000000024C0000-0x0000000002540000-memory.dmp

Filesize
512KB

Download
memory/3000-11-0x000000001B190000-0x000000001B1A2000-memory.dmp

Filesize
72KB

Download
memory/3000-12-0x000007FEF54F0000-0x000007FEF5E8D000-memory.dmp

Filesize
9.6MB

Download