696431978daadd33a28841320659835ba8db8080a535b8f35e9e60701ab8b491

Resubmissions

29/06/2023, 14:46

29/06/2023, 14:43

max time kernel
116s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2023, 14:46

Target

cmdline-tools/bin/retrace.bat
Size

2KB
MD5

7c6c0d79b61e2c6ecc47e6d28137c187
SHA1

0a168aa95bd98d70ade751839426b6b64b832cc5
SHA256

622e033feea65ef9572f4d4778f78d3f925ad8981bb6c824dc31ddd471bd01f3
SHA512

3db1facf4337571aced3574521600f90a2451f6314f46272f996396616b4afcd797a124a245cca02eea32c668bd76cb0e13bc236ae2fe898f23c36698cb8d474

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 496	4748	cmd.exe	86
PID 4748 wrote to memory of 496	4748	cmd.exe	86
PID 4748 wrote to memory of 4732	4748	cmd.exe	87
PID 4748 wrote to memory of 4732	4748	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\retrace.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4748
- C:\ProgramData\Oracle\Java\javapath\java.exe
  java.exe -version
  2⤵
  PID:496
- C:\ProgramData\Oracle\Java\javapath\java.exe
  "java.exe" -classpath "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\..\lib\retrace-classpath.jar" com.android.tools.r8.retrace.Retrace
  2⤵
  PID:4732

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
2212b1179154d5898a542baaacc01d8a

SHA1
c34839c4c1a9b15001fdee784c570f2c36bb3794

SHA256
617931ba41ca6de1627cdbd1fc8f1f3d9b22f3b475139892c114da6b66f52604

SHA512
d6d6ed01f00815743b8558726396ef22f89e89d4e4795f2196e46d09aff138dc58a93ecdef89fe24b1351c1cf810babf17fd1d865cb20b79d14683637dd674dc

Download Submit
memory/496-144-0x0000000002A80000-0x0000000002A81000-memory.dmp

Filesize
4KB

Download
memory/4732-158-0x0000000001000000-0x0000000001001000-memory.dmp

Filesize
4KB

Download