696431978daadd33a28841320659835ba8db8080a535b8f35e9e60701ab8b491

Resubmissions

29/06/2023, 14:46

29/06/2023, 14:43

max time kernel
137s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2023, 14:46

Target

cmdline-tools/bin/screenshot2.bat
Size

2KB
MD5

3de57fbb94c89b5140ea5143daca3755
SHA1

f261b7ef063cef49d0db9589474e7992f3993c77
SHA256

38f1dffb84dce5cb9da608e1b97c9126112cdf81594d24572103f2af7b595b64
SHA512

ac5cce9b03bda4a0c8d772907c74c308b5a5ebc67abc300b92f3988aeca2eb808e43a37cff5201d9c814a8f8426244fade4492dca23c3da8aec0e3ecc7076e73

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1328	1016	cmd.exe	84
PID 1016 wrote to memory of 1328	1016	cmd.exe	84
PID 1016 wrote to memory of 4064	1016	cmd.exe	85
PID 1016 wrote to memory of 4064	1016	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\screenshot2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1016
- C:\ProgramData\Oracle\Java\javapath\java.exe
  java.exe -version
  2⤵
  PID:1328
- C:\ProgramData\Oracle\Java\javapath\java.exe
  "java.exe" -Dcom.android.sdklib.toolsdir=C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\\.. -classpath "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\..\lib\screenshot2-classpath.jar" com.android.screenshot.Screenshot
  2⤵
  PID:4064

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
2a85a9d7607ad27db52c1c682fa680a4

SHA1
160a9abb7faaa35cb6f5f6c729234f881986d87f

SHA256
8e8cc542bf5816bfd6ee6d427aa04c9564ecad1a628859bbc8246e5ba3c4056e

SHA512
43e49a9c6e374ef5a82eeca7846912d3f0396ee9abc5d3d45a54d30753526c96f4c06e5928470c906b95e7e8a60894bbfdf464c0d71ef678df74e1a39f3651f4

Download Submit
memory/1328-144-0x0000000002C90000-0x0000000002C91000-memory.dmp

Filesize
4KB

Download
memory/4064-157-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download