13359f410a45b46e21b37640edb1fabe71d44f503425b019406cd4d8e1d15d5d

Analysis

max time kernel
0s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2024 02:57

Target

1ad4e8a66682dfe74980ee99186517e25a81bd2bf00aafbbafbadc3a63cdd4bf.ps1
Size

1KB
MD5

642f66c6c6b7cfbe0da921ea030df0cb
SHA1

999a425666dad19c246db0775b9cec8d930b40a2
SHA256

1ad4e8a66682dfe74980ee99186517e25a81bd2bf00aafbbafbadc3a63cdd4bf
SHA512

d6f26e731d4415ccfae089c713e7865268532ae8a82c1fd75c9228451fdde33b6e4c6c264fdd7cd807ae06b53ad0265bf6034c7c4c51f3db83b323edad9cba42

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 1484 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1484 powershell.exe
1484 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1484 powershell.exe

flow	pid	process
4	1484	powershell.exe

pid	process
1484	powershell.exe
1484	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1484	powershell.exe

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4t0eqdx0.ucq.ps1
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1484-0-0x000002DF5ABF0000-0x000002DF5AC12000-memory.dmp

Filesize
136KB

Download
memory/1484-12-0x000002DF5AC40000-0x000002DF5AC50000-memory.dmp

Filesize
64KB

Download
memory/1484-11-0x000002DF5AC40000-0x000002DF5AC50000-memory.dmp

Filesize
64KB

Download
memory/1484-10-0x00007FF860540000-0x00007FF861001000-memory.dmp

Filesize
10.8MB

Download
memory/1484-13-0x00007FF860540000-0x00007FF861001000-memory.dmp

Filesize
10.8MB

Download
memory/1484-14-0x000002DF5AC40000-0x000002DF5AC50000-memory.dmp

Filesize
64KB

Download
memory/1484-15-0x000002DF5AC40000-0x000002DF5AC50000-memory.dmp

Filesize
64KB

Download