880f872a96df84217bcca8eb543de65abe9a506cc2df99ee44de801fec9c8b9a

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 14:35

Target

c707720b420b128bb25bedfe7b474e1e.ps1
Size

485KB
MD5

c707720b420b128bb25bedfe7b474e1e
SHA1

e61e9a44d9776dc4bb2387ca89adef76cd23888b
SHA256

880f872a96df84217bcca8eb543de65abe9a506cc2df99ee44de801fec9c8b9a
SHA512

0d2438ec572e416a9dde33aa7a9a9bf3d9b67087c3e3d391480414a2cc0279cb289cf6a82186bc96f908391ff15e8ce6d7e4b80d81adb7bdd36c83ab26e605fa
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64sigu:q3pu

Score

1^/10

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1924	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2988	1924	powershell.exe	29
PID 1924 wrote to memory of 2988	1924	powershell.exe	29
PID 1924 wrote to memory of 2988	1924	powershell.exe	29
PID 1924 wrote to memory of 2988	1924	powershell.exe	29
PID 1924 wrote to memory of 2728	1924	powershell.exe	30
PID 1924 wrote to memory of 2728	1924	powershell.exe	30
PID 1924 wrote to memory of 2728	1924	powershell.exe	30
PID 1924 wrote to memory of 2728	1924	powershell.exe	30
PID 1924 wrote to memory of 2724	1924	powershell.exe	31
PID 1924 wrote to memory of 2724	1924	powershell.exe	31
PID 1924 wrote to memory of 2724	1924	powershell.exe	31
PID 1924 wrote to memory of 2724	1924	powershell.exe	31
PID 1924 wrote to memory of 2700	1924	powershell.exe	32
PID 1924 wrote to memory of 2700	1924	powershell.exe	32
PID 1924 wrote to memory of 2700	1924	powershell.exe	32
PID 1924 wrote to memory of 2700	1924	powershell.exe	32
PID 1924 wrote to memory of 2708	1924	powershell.exe	33
PID 1924 wrote to memory of 2708	1924	powershell.exe	33
PID 1924 wrote to memory of 2708	1924	powershell.exe	33
PID 1924 wrote to memory of 2708	1924	powershell.exe	33

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\c707720b420b128bb25bedfe7b474e1e.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2724
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2708

memory/1924-5-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/1924-4-0x000000001B320000-0x000000001B602000-memory.dmp

Filesize
2.9MB

Download
memory/1924-6-0x00000000025C0000-0x0000000002640000-memory.dmp

Filesize
512KB

Download
memory/1924-8-0x0000000002570000-0x0000000002578000-memory.dmp

Filesize
32KB

Download
memory/1924-9-0x00000000025C0000-0x0000000002640000-memory.dmp

Filesize
512KB

Download
memory/1924-7-0x00000000025C0000-0x0000000002640000-memory.dmp

Filesize
512KB

Download
memory/1924-10-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/1924-11-0x00000000025C0000-0x0000000002640000-memory.dmp

Filesize
512KB

Download
memory/1924-12-0x0000000002980000-0x0000000002992000-memory.dmp

Filesize
72KB

Download
memory/1924-13-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download