696431978daadd33a28841320659835ba8db8080a535b8f35e9e60701ab8b491

Resubmissions

29-06-2023 14:46

29-06-2023 14:43

max time kernel
150s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2023 14:43

Target

cmdline-tools/bin/retrace.bat
Size

2KB
MD5

7c6c0d79b61e2c6ecc47e6d28137c187
SHA1

0a168aa95bd98d70ade751839426b6b64b832cc5
SHA256

622e033feea65ef9572f4d4778f78d3f925ad8981bb6c824dc31ddd471bd01f3
SHA512

3db1facf4337571aced3574521600f90a2451f6314f46272f996396616b4afcd797a124a245cca02eea32c668bd76cb0e13bc236ae2fe898f23c36698cb8d474

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 212	2488	cmd.exe	85
PID 2488 wrote to memory of 212	2488	cmd.exe	85
PID 2488 wrote to memory of 1964	2488	cmd.exe	88
PID 2488 wrote to memory of 1964	2488	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\retrace.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\ProgramData\Oracle\Java\javapath\java.exe
  java.exe -version
  2⤵
  PID:212
- C:\ProgramData\Oracle\Java\javapath\java.exe
  "java.exe" -classpath "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\..\lib\retrace-classpath.jar" com.android.tools.r8.retrace.Retrace
  2⤵
  PID:1964

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
892359d4c591ec45c8df6b5f1c30ce5d

SHA1
7cb96fb87b82b8becf61417c0f3959677ce9bf5c

SHA256
3d03ac8254f6379b47bceeddf9d5bf7235dbc9a28227f12af8eece6ab7ef12f2

SHA512
446ac614c1d73daf0bd3c04e95b15bb1fcdc854981cc1c18e5f8776e3c584c4a757a2467f465e484e401959eb6c3ebe9fec5f98a536030fa5a6ad4e12214368d

Download Submit
memory/212-144-0x0000000002C30000-0x0000000002C31000-memory.dmp

Filesize
4KB

Download
memory/1964-158-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download