13359f410a45b46e21b37640edb1fabe71d44f503425b019406cd4d8e1d15d5d

Analysis

max time kernel
142s
max time network
157s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 02:57

Target

1ad4e8a66682dfe74980ee99186517e25a81bd2bf00aafbbafbadc3a63cdd4bf.ps1
Size

1KB
MD5

642f66c6c6b7cfbe0da921ea030df0cb
SHA1

999a425666dad19c246db0775b9cec8d930b40a2
SHA256

1ad4e8a66682dfe74980ee99186517e25a81bd2bf00aafbbafbadc3a63cdd4bf
SHA512

d6f26e731d4415ccfae089c713e7865268532ae8a82c1fd75c9228451fdde33b6e4c6c264fdd7cd807ae06b53ad0265bf6034c7c4c51f3db83b323edad9cba42

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

2 2316 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2316 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2316 powershell.exe

flow	pid	process
2	2316	powershell.exe

pid	process
2316	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2316	powershell.exe

memory/2316-4-0x000000001B3C0000-0x000000001B6A2000-memory.dmp

Filesize
2.9MB

Download
memory/2316-5-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2316-7-0x0000000002220000-0x0000000002228000-memory.dmp

Filesize
32KB

Download
memory/2316-6-0x0000000002680000-0x0000000002700000-memory.dmp

Filesize
512KB

Download
memory/2316-8-0x0000000002680000-0x0000000002700000-memory.dmp

Filesize
512KB

Download
memory/2316-9-0x0000000002680000-0x0000000002700000-memory.dmp

Filesize
512KB

Download
memory/2316-10-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2316-11-0x0000000002680000-0x0000000002700000-memory.dmp

Filesize
512KB

Download
memory/2316-12-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2316-13-0x0000000002680000-0x0000000002700000-memory.dmp

Filesize
512KB

Download
memory/2316-14-0x0000000002680000-0x0000000002700000-memory.dmp

Filesize
512KB

Download
memory/2316-15-0x0000000002680000-0x0000000002700000-memory.dmp

Filesize
512KB

Download