8f1c851ee5ba2561bf4b912a7a7ebdcfa3288aa9e62fe5ba438188f94af7d33b

Analysis

user interaction
yes
max time kernel
20s
max time network
20s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/10/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
target.ps1
Size 7KB
Sample261023-ncv7escf93
SHA256 8f1c851ee5ba2561bf4b912a7a7ebdcfa3288aa9e62fe5ba438188f94af7d33b
MD5 672f435a1de54fdf61cf10068bc36170
SHA1 2801d1843a3cdf8bcad1d2612fac790915e0ee39
SHA512 9323cb66cf15010ada699fcf0ef1b95d10fc9a56f05cedb6ec11f531a8bd86000ca09f3dd95a56cfa7a36f74bef2b6019eb438312a12305dbfd3fd8383faf21b
SSDEEP 192:2d/y4yPoUQ4DUewlEKQ4HyJbU7O14PMsfrT4:2da4yPHMEan4
TLSH
T19CF1CA269902E86A19BB132ACDE19450FF321077839A1DF4799C80D81FFD13E8375E95
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4312	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4312	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4312	PowerShell.exe
4312	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	PowerShell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 1300	4312	PowerShell.exe	83
PID 1300 wrote to memory of 4392	1300	csc.exe	84

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\10p1stqa\10p1stqa.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4590.tmp" "c:\Users\Admin\AppData\Local\Temp\10p1stqa\CSC5103FA70DFE44B18B4C899FF97A34445.TMP"
    3⤵
    PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10p1stqa.dll

Path C:\Users\Admin\AppData\Local\Temp\10p1stqa\10p1stqa.dll
Size 5KB
SHA256 6b08c3f3e8f34c6f9ab8ba9e01a4e5e7f1db0d0edb6c97949638e69132c5965c
MD5 957e999cab05fdacaab88a9ec5877665
SHA1 f833ef7cf34bdfa4de15cbb9560fecb5762fd2c3
SHA512 f2d263af4a5c73009031dd13d525e42da8a91997f61255234db54841061b1d91485999690a4521fa55ddf9bd139d83dde8dfcb922775b7cbda260f48968c5c7c
SSDEEP 48:64wpGh1HMzA7XnRq8UEDVJV7l4JYhfJaNgYJY4cwq8RuLtv7gmp65EwvHzqkGoAa:wTzAbRq8tnVxNcJY4Iv8TqSzvK
TLSH
T18DB13F1AB7E84127F47B4332A8F2832363B7B5199E37D79E08981F5C9CA6B405960E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES4590.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4590.tmp
Size 1KB
SHA256 d461c526dafcf2c2e425c0b2782cc0cb0eb005e0a2b71f72521a0c4decb64e49
MD5 e1bd7d2a2c7c4810846bdf315e12fc98
SHA1 be8f3e9f15f6efd4ed7d95075caf174a37be1d4f
SHA512 6998da76625b91d1a9f2ea778a3623f41b1e56bf4858217143e0534a8b30251ed680be081d7e3ceb3ad65058688a5de308bd0b1e35f528fa1c4830adc2fe8898
TLSH
T1B121AF0193E94B0EF0731B3169F6232FA278FD54EF62975B8580522C2C41208EEB1F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ixil3dvm.ejr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ixil3dvm.ejr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

10p1stqa.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\10p1stqa\10p1stqa.0.cs
Size 2KB
SHA256 1c7b7b881c3791c42e85d8580d0bef18b7f1fd759ad1765ad7fa26c7e9442af5
MD5 b325dba5f36c1d611b48082fbe5c94c8
SHA1 f05ba217e38fd4b6114ca5621a56ec1d89f79692
SHA512 ec1701313534533a487fcdcc4eb32ace78220d2b065306782c98ae9549bce57f9e164410a96b73ce5ac4dcad582a5f15afe685c86ba2eea53694cf4dc3efd9d4
TLSH
T138410142D642E9656CB22515DFF08CB6EB3362A343F665B0BDAD84920F3D0394270DF5
MD5 SHA1 SHA512 TLSH

Submit Download

10p1stqa.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\10p1stqa\10p1stqa.cmdline
Size 369B
SHA256 799f0e7905c0e9adfe026610d9c4193af13ffe6f8fa4ec9b829bc3e02f9c8903
MD5 64f8b3644b809e6f9a3b9b9139187301
SHA1 2ec225a62faeafc7638186852bbafeca8ac4223b
SHA512 e920c3507db065dadcffa741eef990e1b1f500ca7d96103802a5153296fb901dafbd1b6ae67aafcf938a937abeb7c2c26478c22ca4132bb0a70ca649d585a9a4
TLSH
T1DCE0C03B4247C77E15DD300721A9E4ACEB76474339843F845040462DE057110A7E27C1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5103FA70DFE44B18B4C899FF97A34445.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\10p1stqa\CSC5103FA70DFE44B18B4C899FF97A34445.TMP
Size 652B
SHA256 efa6ea022b22d631ccf6f8626396c7a60576e7143d66348fa73adab18eb9ee1a
MD5 9361463542a7ad510024a6fe7948300a
SHA1 50e9b8e0e7bbc1e4efa396a77c67b1390da1435a
SHA512 2cc51b18789e86713001409c55a9e67ab80beb6f1b0ed474cf2fc73940f695582d4f25d77b6e418ed790e4e4349ecd428b2dc338c877cb8f692114783be994da
TLSH
T14BF03A0AB3F8420AF0F34F31B9F6536391ACBC64DE32A3ED5590032D28645149A62FB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4312-9-0x000001B29AFC0000-0x000001B29AFD0000-memory.dmp

Download

memory/4312-0-0x000001B29AFC0000-0x000001B29AFD0000-memory.dmp

Download

memory/4312-8-0x000001B2FF1A0000-0x000001B2FF1C2000-memory.dmp

Download

memory/4312-22-0x000001B29D260000-0x000001B29D268000-memory.dmp

Download

memory/4312-1-0x000001B29AFC0000-0x000001B29AFD0000-memory.dmp

Download

memory/4312-23-0x000001B2FF7D0000-0x000001B2FF992000-memory.dmp

Download

memory/4312-24-0x000001B29DAE0000-0x000001B29E008000-memory.dmp

Download

memory/4312-26-0x000001B29AFC0000-0x000001B29AFD0000-memory.dmp

Download

memory/4312-27-0x000001B29AFC0000-0x000001B29AFD0000-memory.dmp

Download

memory/4312-28-0x000001B29AFC0000-0x000001B29AFD0000-memory.dmp

Download