696431978daadd33a28841320659835ba8db8080a535b8f35e9e60701ab8b491 | Triage

Resubmissions

29/06/2023, 14:46 UTC

230629-r5stjsdf66 5

29/06/2023, 14:43 UTC

230629-r3tm3aed4y 5

Analysis

max time kernel
31s
max time network
42s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29/06/2023, 14:46 UTC

Sharing

Report Analysis Logs

General

Target

cmdline-tools/bin/profgen.bat
Size

2KB
MD5

06f9d03dc3d66563374e5fad1c712f25
SHA1

809741477a45312fc53a1bd8332f4dbf82c5cd2b
SHA256

c38ae27434593691b385df4a38ec264895c6243eaaed574f3956e55d46d4eab4
SHA512

18676d09029f41862e9a5db968cccb362227d92e2a49c64f427b377b8ee7ad6442e555056f941cee2814e1ab677fbb134f807ad48b84b92314592551c40bf2d3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1376	1340	cmd.exe	29
PID 1340 wrote to memory of 1376	1340	cmd.exe	29
PID 1340 wrote to memory of 1376	1340	cmd.exe	29
PID 1340 wrote to memory of 1864	1340	cmd.exe	30
PID 1340 wrote to memory of 1864	1340	cmd.exe	30
PID 1340 wrote to memory of 1864	1340	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\profgen.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\system32\java.exe
  java.exe -version
  2⤵
  PID:1376
- C:\Windows\system32\java.exe
  "java.exe" -classpath "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\..\lib\profgen-classpath.jar" com.android.tools.profgen.cli.MainKt
  2⤵
  PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-64-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1376-65-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1864-76-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/1864-77-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download