696431978daadd33a28841320659835ba8db8080a535b8f35e9e60701ab8b491

Resubmissions

29/06/2023, 14:46

29/06/2023, 14:43

max time kernel
75s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2023, 14:46

Target

cmdline-tools/bin/profgen.bat
Size

2KB
MD5

06f9d03dc3d66563374e5fad1c712f25
SHA1

809741477a45312fc53a1bd8332f4dbf82c5cd2b
SHA256

c38ae27434593691b385df4a38ec264895c6243eaaed574f3956e55d46d4eab4
SHA512

18676d09029f41862e9a5db968cccb362227d92e2a49c64f427b377b8ee7ad6442e555056f941cee2814e1ab677fbb134f807ad48b84b92314592551c40bf2d3

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 5084	1296	cmd.exe	88
PID 1296 wrote to memory of 5084	1296	cmd.exe	88
PID 1296 wrote to memory of 2600	1296	cmd.exe	90
PID 1296 wrote to memory of 2600	1296	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\profgen.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\ProgramData\Oracle\Java\javapath\java.exe
  java.exe -version
  2⤵
  PID:5084
- C:\ProgramData\Oracle\Java\javapath\java.exe
  "java.exe" -classpath "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\..\lib\profgen-classpath.jar" com.android.tools.profgen.cli.MainKt
  2⤵
  PID:2600

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
0078fa33c12d4ec89e93e59872a13bb5

SHA1
8b0fa772d89faf5a1d918259095c882f09742e11

SHA256
31a9aa5ed730595af39d3633557f4a8f513b31e823241912f83c879bb6ea4a4e

SHA512
6309e7866a652bb715a85e3e6d13a1d5f7ee375c463c66dfa77c6a9defc4285147d1866fb4878cd367e32f5d060871e85886bd2601d291c4b7092b39d03851d5

Download Submit
memory/2600-157-0x0000000002D50000-0x0000000002D51000-memory.dmp

Filesize
4KB

Download
memory/5084-144-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download