696431978daadd33a28841320659835ba8db8080a535b8f35e9e60701ab8b491

Resubmissions

29/06/2023, 14:46

29/06/2023, 14:43

max time kernel
73s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2023, 14:46

Target

cmdline-tools/bin/sdkmanager.bat
Size

2KB
MD5

0cbc41b0d09381a0a8a054378d90d163
SHA1

cce511a45fe04bfa216d82195b45b7675f755ba0
SHA256

14866e8b3ede1d90b633042748254bd264e0678f68b9390540e839588dbb47f4
SHA512

d8449fec7ebae25394802be91f9b9197169c02aa8d6fe75893e1a3b7d4f85ce27256f210b965457e9839b5a058ddd4a1d78c34843b442926fd797669a4d884e2

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 1492	8	cmd.exe	83
PID 8 wrote to memory of 1492	8	cmd.exe	83
PID 8 wrote to memory of 3672	8	cmd.exe	85
PID 8 wrote to memory of 3672	8	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\sdkmanager.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\ProgramData\Oracle\Java\javapath\java.exe
  java.exe -version
  2⤵
  PID:1492
- C:\ProgramData\Oracle\Java\javapath\java.exe
  "java.exe" "-Dcom.android.sdklib.toolsdir=C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\\.." -classpath "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\..\lib\sdkmanager-classpath.jar" com.android.sdklib.tool.sdkmanager.SdkManagerCli
  2⤵
  PID:3672

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
630e953e5a99f399a9b114cebb2c4bd4

SHA1
a6da122126b2e2ff480509b35edf91502c367da2

SHA256
fc6cd22d432452931d8b1b29e4f56902571887fe4b1b1a319dcf3381e1b6b11b

SHA512
bfab60b9a627157fcd3044ef4442da292c9d51ab95c88c218e76318bbc4195028b83ada694be87b78922b52cbf721dd5272ce6e2ec58582c32432c6d7864e516

Download Submit
memory/1492-144-0x0000000001420000-0x0000000001421000-memory.dmp

Filesize
4KB

Download
memory/3672-157-0x0000000002B50000-0x0000000002B51000-memory.dmp

Filesize
4KB

Download