3f80c20fecafcfa264532eae938edb81dd04c8d0335c366f0b3c4c64ad529967

Analysis

max time kernel
134s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2024 23:27

Target

data/appInfo/UqYyr4PZlPm4.ps1
Size

150KB
MD5

97faa935235531bac529a1eb0a533df1
SHA1

0cdbcf1d9534b593a5cb33843a9e8d0445c91f97
SHA256

d8df009acf37dd59649a8f618b8e16ba67cace1746f86fab120715399f7c2890
SHA512

6d3b680de730e83921452cf48c0d11062710d26d371076a3406ab7b36294d510b47cfcae80996381c06606636637eea5a55f8d79a38ad88f4a4364d397aa0cf9
SSDEEP

3072:8FWJgA0YaAcuTjzDaa5WrTS2R+TlpFczpa9Ikmeiqe6Ix2EeJg2xb:88Fc4b4EpFczpa4+Eei2p

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

380 powershell.exe
380 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exeAUDIODG.EXE

description pid process

Token: SeDebugPrivilege 380 powershell.exe
Token: 33 5012 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 5012 AUDIODG.EXE

pid	process
380	powershell.exe
380	powershell.exe

description	pid	process
Token: SeDebugPrivilege	380	powershell.exe
Token: 33	5012	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5012	AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x404 0x33c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5012

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dl1mlrct.afb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/380-9-0x00000230F2D70000-0x00000230F2D92000-memory.dmp

Filesize
136KB

Download
memory/380-10-0x00007FFA2ECD0000-0x00007FFA2F791000-memory.dmp

Filesize
10.8MB

Download
memory/380-11-0x00000230F0A50000-0x00000230F0A60000-memory.dmp

Filesize
64KB

Download
memory/380-12-0x00000230F0A50000-0x00000230F0A60000-memory.dmp

Filesize
64KB

Download
memory/380-13-0x00000230F0A50000-0x00000230F0A60000-memory.dmp

Filesize
64KB

Download
memory/380-16-0x00007FFA2ECD0000-0x00007FFA2F791000-memory.dmp

Filesize
10.8MB

Download