5cebcbf67061e7d243a9a54e4b0d27e25337dfd1ee9fcfb61ae9bb3ddd89870f

Analysis

max time kernel
3s
max time network
7s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 20:16

Target

childdcscript2.ps1
Size

1KB
MD5

4e76a15aa7886cb6323a8e417c91a0fa
SHA1

a49cb723e567bf13e379bc38b12d77fd56bd0636
SHA256

5cebcbf67061e7d243a9a54e4b0d27e25337dfd1ee9fcfb61ae9bb3ddd89870f
SHA512

e530c3de0fb9cc65f30e15b013ef0ea17925e6b390d8087039bdc199567be99e8fd1bf5e2793365d4b723eecba80d6e800233817a0f6d1c3cc8f04f766290a04

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

932 powershell.exe
932 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 932 powershell.exe

pid	process
932	powershell.exe
932	powershell.exe

description	pid	process
Token: SeDebugPrivilege	932	powershell.exe

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0cn0kmeb.u3i.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/932-0-0x00007FF83DF33000-0x00007FF83DF35000-memory.dmp

Filesize
8KB

Download
memory/932-6-0x0000018DBC0D0000-0x0000018DBC0F2000-memory.dmp

Filesize
136KB

Download
memory/932-11-0x00007FF83DF30000-0x00007FF83E9F1000-memory.dmp

Filesize
10.8MB

Download
memory/932-12-0x00007FF83DF30000-0x00007FF83E9F1000-memory.dmp

Filesize
10.8MB

Download
memory/932-15-0x00007FF83DF30000-0x00007FF83E9F1000-memory.dmp

Filesize
10.8MB

Download
memory/932-16-0x00007FF83DF30000-0x00007FF83E9F1000-memory.dmp

Filesize
10.8MB

Download