696431978daadd33a28841320659835ba8db8080a535b8f35e9e60701ab8b491

Resubmissions

29/06/2023, 14:46

29/06/2023, 14:43

max time kernel
127s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2023, 14:43

Target

cmdline-tools/bin/sdkmanager.bat
Size

2KB
MD5

0cbc41b0d09381a0a8a054378d90d163
SHA1

cce511a45fe04bfa216d82195b45b7675f755ba0
SHA256

14866e8b3ede1d90b633042748254bd264e0678f68b9390540e839588dbb47f4
SHA512

d8449fec7ebae25394802be91f9b9197169c02aa8d6fe75893e1a3b7d4f85ce27256f210b965457e9839b5a058ddd4a1d78c34843b442926fd797669a4d884e2

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 3140	4472	cmd.exe	83
PID 4472 wrote to memory of 3140	4472	cmd.exe	83
PID 4472 wrote to memory of 4364	4472	cmd.exe	87
PID 4472 wrote to memory of 4364	4472	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\sdkmanager.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\ProgramData\Oracle\Java\javapath\java.exe
  java.exe -version
  2⤵
  PID:3140
- C:\ProgramData\Oracle\Java\javapath\java.exe
  "java.exe" "-Dcom.android.sdklib.toolsdir=C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\\.." -classpath "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\..\lib\sdkmanager-classpath.jar" com.android.sdklib.tool.sdkmanager.SdkManagerCli
  2⤵
  PID:4364

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
ba7484f12f3d34a883415e0cd5ee8573

SHA1
c1b9ab495acb514189645cdef00a7cab1edec98d

SHA256
e855ffe2cc29bdb38f058e3ef6ccd0841a4a20d35e327f1f5162be98e016c7d3

SHA512
5b1f2b27e283712d2535d2680be1f0a774626d8c759e791b8ca6f0d16313f045b2fbeaee0e7ced84a4a20b6dcfd752e0d67d84fb52de36c3b4499e19bcdf8e8d

Download Submit
memory/3140-144-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/4364-157-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download