696431978daadd33a28841320659835ba8db8080a535b8f35e9e60701ab8b491 | Triage

Resubmissions

29-06-2023 14:46

230629-r5stjsdf66 5

29-06-2023 14:43

230629-r3tm3aed4y 5

Analysis

max time kernel
23s
max time network
35s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29-06-2023 14:43

Sharing

Report Analysis Logs

General

Target

cmdline-tools/bin/profgen.bat
Size

2KB
MD5

06f9d03dc3d66563374e5fad1c712f25
SHA1

809741477a45312fc53a1bd8332f4dbf82c5cd2b
SHA256

c38ae27434593691b385df4a38ec264895c6243eaaed574f3956e55d46d4eab4
SHA512

18676d09029f41862e9a5db968cccb362227d92e2a49c64f427b377b8ee7ad6442e555056f941cee2814e1ab677fbb134f807ad48b84b92314592551c40bf2d3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2008	1996	cmd.exe	29
PID 1996 wrote to memory of 2008	1996	cmd.exe	29
PID 1996 wrote to memory of 2008	1996	cmd.exe	29
PID 1996 wrote to memory of 600	1996	cmd.exe	30
PID 1996 wrote to memory of 600	1996	cmd.exe	30
PID 1996 wrote to memory of 600	1996	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\profgen.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\system32\java.exe
  java.exe -version
  2⤵
  PID:2008
- C:\Windows\system32\java.exe
  "java.exe" -classpath "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\..\lib\profgen-classpath.jar" com.android.tools.profgen.cli.MainKt
  2⤵
  PID:600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/600-76-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/600-77-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2008-64-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2008-65-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download