696431978daadd33a28841320659835ba8db8080a535b8f35e9e60701ab8b491

Resubmissions

29/06/2023, 14:46

29/06/2023, 14:43

max time kernel
151s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2023, 14:43

Target

cmdline-tools/bin/profgen.bat
Size

2KB
MD5

06f9d03dc3d66563374e5fad1c712f25
SHA1

809741477a45312fc53a1bd8332f4dbf82c5cd2b
SHA256

c38ae27434593691b385df4a38ec264895c6243eaaed574f3956e55d46d4eab4
SHA512

18676d09029f41862e9a5db968cccb362227d92e2a49c64f427b377b8ee7ad6442e555056f941cee2814e1ab677fbb134f807ad48b84b92314592551c40bf2d3

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 1140	3544	cmd.exe	85
PID 3544 wrote to memory of 1140	3544	cmd.exe	85
PID 3544 wrote to memory of 940	3544	cmd.exe	87
PID 3544 wrote to memory of 940	3544	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\profgen.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3544
- C:\ProgramData\Oracle\Java\javapath\java.exe
  java.exe -version
  2⤵
  PID:1140
- C:\ProgramData\Oracle\Java\javapath\java.exe
  "java.exe" -classpath "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\..\lib\profgen-classpath.jar" com.android.tools.profgen.cli.MainKt
  2⤵
  PID:940

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
aa5650700b0d81c16ce7f2f7a7c6389f

SHA1
214134b1a7b6cbe0e67815f72503cdb6073ad67d

SHA256
6dcdeb1f8d534517342f2822de3644618336766cd05e13dd2ec2fc4b40dcb735

SHA512
bcd9ec242f28057e356e36568fc68288fd3d4722ec4312478bed8bc7f39184dee2df94c1b2be8d5365dee761f11f5c605b69e0da3a9505dc516e8c25b28f2de4

Download Submit
memory/940-157-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/1140-144-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download