696431978daadd33a28841320659835ba8db8080a535b8f35e9e60701ab8b491

Resubmissions

29/06/2023, 14:46

29/06/2023, 14:43

max time kernel
150s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2023, 14:43

Target

cmdline-tools/bin/screenshot2.bat
Size

2KB
MD5

3de57fbb94c89b5140ea5143daca3755
SHA1

f261b7ef063cef49d0db9589474e7992f3993c77
SHA256

38f1dffb84dce5cb9da608e1b97c9126112cdf81594d24572103f2af7b595b64
SHA512

ac5cce9b03bda4a0c8d772907c74c308b5a5ebc67abc300b92f3988aeca2eb808e43a37cff5201d9c814a8f8426244fade4492dca23c3da8aec0e3ecc7076e73

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 5028	4164	cmd.exe	83
PID 4164 wrote to memory of 5028	4164	cmd.exe	83
PID 4164 wrote to memory of 1540	4164	cmd.exe	84
PID 4164 wrote to memory of 1540	4164	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\screenshot2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4164
- C:\ProgramData\Oracle\Java\javapath\java.exe
  java.exe -version
  2⤵
  PID:5028
- C:\ProgramData\Oracle\Java\javapath\java.exe
  "java.exe" -Dcom.android.sdklib.toolsdir=C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\\.. -classpath "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\..\lib\screenshot2-classpath.jar" com.android.screenshot.Screenshot
  2⤵
  PID:1540

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
d0745dd2e17f5e5f254c0cc4f6c74b33

SHA1
c8ced6b04cbba5fd96ffe4ff93c29d5f34a47831

SHA256
12fe257bbcb195e8f2365f0519c341c23160da5a653efbcf2c9dd1977f2eff18

SHA512
1411558000883d3333a1b309a553ddc99d3f43b58a061b82de72a34564014005cc025c4d3d95b971ab66a770e5ebfe6b85eb58a164dc33b136dfb0d6e30e8db6

Download Submit
memory/1540-157-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

Filesize
4KB

Download
memory/5028-144-0x00000000014B0000-0x00000000014B1000-memory.dmp

Filesize
4KB

Download