ae4c8d37a496b43f8974ba8f07f708e22a9570ba0cddc3dc3a36edbccd4d2a20

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2023, 12:49

Target

scrcpy-win64-v2.0/scrcpy-console.bat
Size

90B
MD5

4cf35ee151e711be8d8d8ad5e4e929da
SHA1

7c8f5111c968b435dd64fb781806b6dc72a4ea52
SHA256

dc797a0ba51b42e3f965b5368adfa7accbd280aee8efa46f313b69ff8f403e16
SHA512

f33616df6a9dcc92b463a690928e88be65a229b72ad933243d4c56966ea44644e13df26faf170852a0ad79f6fa0cf22f44855a3c6b1990bac046940f3b2da5d2

Score

1^/10

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 3652	1344	cmd.exe	85
PID 1344 wrote to memory of 3652	1344	cmd.exe	85
PID 3652 wrote to memory of 4180	3652	scrcpy.exe	86
PID 3652 wrote to memory of 4180	3652	scrcpy.exe	86
PID 3652 wrote to memory of 4180	3652	scrcpy.exe	86
PID 4180 wrote to memory of 3760	4180	adb.exe	87
PID 4180 wrote to memory of 3760	4180	adb.exe	87
PID 4180 wrote to memory of 3760	4180	adb.exe	87
PID 3652 wrote to memory of 3712	3652	scrcpy.exe	88
PID 3652 wrote to memory of 3712	3652	scrcpy.exe	88
PID 3652 wrote to memory of 3712	3652	scrcpy.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\scrcpy-console.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\scrcpy.exe
  scrcpy.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\adb.exe
    adb start-server
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\adb.exe
      adb -L tcp:5037 fork-server server --reply-fd 604
      4⤵
      PID:3760
- - C:\Users\Admin\AppData\Local\Temp\scrcpy-win64-v2.0\adb.exe
    adb devices -l
    3⤵
    PID:3712

memory/3652-136-0x00007FF6ECB30000-0x00007FF6ECC3D000-memory.dmp

Filesize
1.1MB

Download
memory/3652-137-0x00007FF8ABF10000-0x00007FF8ABF94000-memory.dmp

Filesize
528KB

Download
memory/3652-138-0x00007FF8ABD00000-0x00007FF8ABF03000-memory.dmp

Filesize
2.0MB

Download
memory/3652-139-0x00007FF8AB7C0000-0x00007FF8ABA2E000-memory.dmp

Filesize
2.4MB

Download
memory/3652-140-0x0000000070980000-0x00000000709B4000-memory.dmp

Filesize
208KB

Download
memory/3652-141-0x00007FF8AC060000-0x00007FF8AC087000-memory.dmp

Filesize
156KB

Download
memory/3652-142-0x00007FF8AB460000-0x00007FF8AB7B9000-memory.dmp

Filesize
3.3MB

Download
memory/3652-143-0x00007FF8ABCD0000-0x00007FF8ABCFA000-memory.dmp

Filesize
168KB

Download