696431978daadd33a28841320659835ba8db8080a535b8f35e9e60701ab8b491

Resubmissions

29/06/2023, 14:46

29/06/2023, 14:43

max time kernel
30s
max time network
40s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29/06/2023, 14:46

Target

cmdline-tools/bin/screenshot2.bat
Size

2KB
MD5

3de57fbb94c89b5140ea5143daca3755
SHA1

f261b7ef063cef49d0db9589474e7992f3993c77
SHA256

38f1dffb84dce5cb9da608e1b97c9126112cdf81594d24572103f2af7b595b64
SHA512

ac5cce9b03bda4a0c8d772907c74c308b5a5ebc67abc300b92f3988aeca2eb808e43a37cff5201d9c814a8f8426244fade4492dca23c3da8aec0e3ecc7076e73

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 936	1780	cmd.exe	29
PID 1780 wrote to memory of 936	1780	cmd.exe	29
PID 1780 wrote to memory of 936	1780	cmd.exe	29
PID 1780 wrote to memory of 776	1780	cmd.exe	30
PID 1780 wrote to memory of 776	1780	cmd.exe	30
PID 1780 wrote to memory of 776	1780	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\screenshot2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\system32\java.exe
  java.exe -version
  2⤵
  PID:936
- C:\Windows\system32\java.exe
  "java.exe" -Dcom.android.sdklib.toolsdir=C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\\.. -classpath "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\..\lib\screenshot2-classpath.jar" com.android.screenshot.Screenshot
  2⤵
  PID:776

memory/776-76-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/776-77-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/936-64-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/936-65-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download