dbbf8efa02391fa962053f41608e640d7cfcfb10f241feaa7fd3f962e6310342

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 14:40

Target

c84af18c253798e3c6321c2a7048e385.ps1
Size

485KB
MD5

c84af18c253798e3c6321c2a7048e385
SHA1

f861c48c8a1087ba3763cba302453c2a187a1faf
SHA256

dbbf8efa02391fa962053f41608e640d7cfcfb10f241feaa7fd3f962e6310342
SHA512

eeff3da876922081b3608f7c43f89ae55a4d32a2c32f74e16abba43ae7de306b707622f2082fba47664b53e6c3ce29ae72b701100c18a05e0de863a597398b5a
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64qigu:q3ju

Score

1^/10

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2784	2004	powershell.exe	29
PID 2004 wrote to memory of 2784	2004	powershell.exe	29
PID 2004 wrote to memory of 2784	2004	powershell.exe	29
PID 2004 wrote to memory of 2784	2004	powershell.exe	29
PID 2004 wrote to memory of 2788	2004	powershell.exe	30
PID 2004 wrote to memory of 2788	2004	powershell.exe	30
PID 2004 wrote to memory of 2788	2004	powershell.exe	30
PID 2004 wrote to memory of 2788	2004	powershell.exe	30
PID 2004 wrote to memory of 2800	2004	powershell.exe	31
PID 2004 wrote to memory of 2800	2004	powershell.exe	31
PID 2004 wrote to memory of 2800	2004	powershell.exe	31
PID 2004 wrote to memory of 2800	2004	powershell.exe	31
PID 2004 wrote to memory of 2812	2004	powershell.exe	32
PID 2004 wrote to memory of 2812	2004	powershell.exe	32
PID 2004 wrote to memory of 2812	2004	powershell.exe	32
PID 2004 wrote to memory of 2812	2004	powershell.exe	32
PID 2004 wrote to memory of 2976	2004	powershell.exe	33
PID 2004 wrote to memory of 2976	2004	powershell.exe	33
PID 2004 wrote to memory of 2976	2004	powershell.exe	33
PID 2004 wrote to memory of 2976	2004	powershell.exe	33

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\c84af18c253798e3c6321c2a7048e385.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2788
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2812
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2976

memory/2004-4-0x000000001B1A0000-0x000000001B482000-memory.dmp

Filesize
2.9MB

Download
memory/2004-6-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2004-7-0x00000000025E0000-0x0000000002660000-memory.dmp

Filesize
512KB

Download
memory/2004-8-0x00000000025E0000-0x0000000002660000-memory.dmp

Filesize
512KB

Download
memory/2004-9-0x00000000025E0000-0x0000000002660000-memory.dmp

Filesize
512KB

Download
memory/2004-5-0x0000000001FD0000-0x0000000001FD8000-memory.dmp

Filesize
32KB

Download
memory/2004-10-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2004-11-0x00000000025E0000-0x0000000002660000-memory.dmp

Filesize
512KB

Download
memory/2004-12-0x000000001B600000-0x000000001B612000-memory.dmp

Filesize
72KB

Download
memory/2004-13-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download