696431978daadd33a28841320659835ba8db8080a535b8f35e9e60701ab8b491

Resubmissions

29/06/2023, 14:46

29/06/2023, 14:43

max time kernel
29s
max time network
36s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29/06/2023, 14:43

Target

cmdline-tools/bin/avdmanager.bat
Size

2KB
MD5

25b67faa0ea0c974fec73cc1debca0e6
SHA1

61829f12895c84b4d51d8029b458dd3bd438f521
SHA256

b3f30c7965527923691cb71f04515e2d3847abaf57836f588f9d5f918288757c
SHA512

07f529b52bf644bd9feb7b9380b88d20ff0803dacb335a3f17925ef4a9a52412305b1589fd7c77c3da08ad76e9029c9c049ecdaf5c05329ecbf7960b4472693b

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1192	2012	cmd.exe	29
PID 2012 wrote to memory of 1192	2012	cmd.exe	29
PID 2012 wrote to memory of 1192	2012	cmd.exe	29
PID 2012 wrote to memory of 764	2012	cmd.exe	30
PID 2012 wrote to memory of 764	2012	cmd.exe	30
PID 2012 wrote to memory of 764	2012	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\avdmanager.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\system32\java.exe
  java.exe -version
  2⤵
  PID:1192
- C:\Windows\system32\java.exe
  "java.exe" "-Dcom.android.sdkmanager.toolsdir=C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\\.." -classpath "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\..\lib\avdmanager-classpath.jar" com.android.sdklib.tool.AvdManagerCli
  2⤵
  PID:764

memory/764-76-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1192-64-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1192-65-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download