e50457d38e4cd7424a17fa563b9a40c1db3d81a4ad29ffda9a50dad7327ade58

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-01-2024 11:56

Target

678fe2eeaa5398e8366ede0ba83216f7.ps1
Size

485KB
MD5

678fe2eeaa5398e8366ede0ba83216f7
SHA1

1b5f150b389e61b155f75a6b374f8aa02ec0a93f
SHA256

e50457d38e4cd7424a17fa563b9a40c1db3d81a4ad29ffda9a50dad7327ade58
SHA512

d4533677f984fdf9025f69ae20a2ffcf2b274647bde07954eedc502e1702d13bcab3e8c293e1adadd0bdcd5e145434ede1be14453e576c7a05fae8fb4e085b97
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw641igu:q3qu

Score

1^/10

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2676	2220	powershell.exe	29
PID 2220 wrote to memory of 2676	2220	powershell.exe	29
PID 2220 wrote to memory of 2676	2220	powershell.exe	29
PID 2220 wrote to memory of 2676	2220	powershell.exe	29
PID 2220 wrote to memory of 2812	2220	powershell.exe	30
PID 2220 wrote to memory of 2812	2220	powershell.exe	30
PID 2220 wrote to memory of 2812	2220	powershell.exe	30
PID 2220 wrote to memory of 2812	2220	powershell.exe	30
PID 2220 wrote to memory of 2096	2220	powershell.exe	31
PID 2220 wrote to memory of 2096	2220	powershell.exe	31
PID 2220 wrote to memory of 2096	2220	powershell.exe	31
PID 2220 wrote to memory of 2096	2220	powershell.exe	31
PID 2220 wrote to memory of 2820	2220	powershell.exe	32
PID 2220 wrote to memory of 2820	2220	powershell.exe	32
PID 2220 wrote to memory of 2820	2220	powershell.exe	32
PID 2220 wrote to memory of 2820	2220	powershell.exe	32
PID 2220 wrote to memory of 3012	2220	powershell.exe	33
PID 2220 wrote to memory of 3012	2220	powershell.exe	33
PID 2220 wrote to memory of 3012	2220	powershell.exe	33
PID 2220 wrote to memory of 3012	2220	powershell.exe	33

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\678fe2eeaa5398e8366ede0ba83216f7.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2812
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2820
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:3012

memory/2220-4-0x000000001B230000-0x000000001B512000-memory.dmp

Filesize
2.9MB

Download
memory/2220-6-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/2220-7-0x0000000002670000-0x00000000026F0000-memory.dmp

Filesize
512KB

Download
memory/2220-8-0x0000000002670000-0x00000000026F0000-memory.dmp

Filesize
512KB

Download
memory/2220-9-0x0000000002670000-0x00000000026F0000-memory.dmp

Filesize
512KB

Download
memory/2220-5-0x0000000001ED0000-0x0000000001ED8000-memory.dmp

Filesize
32KB

Download
memory/2220-10-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download
memory/2220-11-0x0000000002670000-0x00000000026F0000-memory.dmp

Filesize
512KB

Download
memory/2220-12-0x0000000002340000-0x0000000002352000-memory.dmp

Filesize
72KB

Download
memory/2220-13-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmp

Filesize
9.6MB

Download