696431978daadd33a28841320659835ba8db8080a535b8f35e9e60701ab8b491

Resubmissions

29/06/2023, 14:46

29/06/2023, 14:43

max time kernel
21s
max time network
32s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29/06/2023, 14:46

Target

cmdline-tools/bin/sdkmanager.bat
Size

2KB
MD5

0cbc41b0d09381a0a8a054378d90d163
SHA1

cce511a45fe04bfa216d82195b45b7675f755ba0
SHA256

14866e8b3ede1d90b633042748254bd264e0678f68b9390540e839588dbb47f4
SHA512

d8449fec7ebae25394802be91f9b9197169c02aa8d6fe75893e1a3b7d4f85ce27256f210b965457e9839b5a058ddd4a1d78c34843b442926fd797669a4d884e2

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1992	1996	cmd.exe	28
PID 1996 wrote to memory of 1992	1996	cmd.exe	28
PID 1996 wrote to memory of 1992	1996	cmd.exe	28
PID 1996 wrote to memory of 1856	1996	cmd.exe	29
PID 1996 wrote to memory of 1856	1996	cmd.exe	29
PID 1996 wrote to memory of 1856	1996	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\sdkmanager.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\system32\java.exe
  java.exe -version
  2⤵
  PID:1992
- C:\Windows\system32\java.exe
  "java.exe" "-Dcom.android.sdklib.toolsdir=C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\\.." -classpath "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\..\lib\sdkmanager-classpath.jar" com.android.sdklib.tool.sdkmanager.SdkManagerCli
  2⤵
  PID:1856

memory/1856-76-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/1992-64-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1992-65-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download