759cf2018b43bd88ff69b4736e91c3c76f16f5788e44af7e42b0124c35daa210

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/12/2023, 00:38

Target

LEDAMA VPN NO ADDTIME/LEDAMA VPN SOCKS/gradlew.bat
Size

2KB
MD5

0ea6d812cf51675a8503fe23ae178996
SHA1

8751d7831ca6cd1cad48e1475a79596b54b48994
SHA256

f4f428c5626b3d90cef3bd4e7fd3ad3ea5760442db8c09d586b5bfe031dbe5e3
SHA512

ea052888a8e361670cd7051c6313fc838f579a54288ed391361954f413df699c119236e7371149939045cd3aef48458d4991beed579e3cc1230e3bee1273de8f

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1968	1044	cmd.exe	29
PID 1044 wrote to memory of 1968	1044	cmd.exe	29
PID 1044 wrote to memory of 1968	1044	cmd.exe	29
PID 1044 wrote to memory of 2588	1044	cmd.exe	30
PID 1044 wrote to memory of 2588	1044	cmd.exe	30
PID 1044 wrote to memory of 2588	1044	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\LEDAMA VPN NO ADDTIME\LEDAMA VPN SOCKS\gradlew.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\system32\java.exe
  java.exe -version
  2⤵
  PID:1968
- C:\Windows\system32\java.exe
  "java.exe" "-Dorg.gradle.appname=gradlew" -classpath "C:\Users\Admin\AppData\Local\Temp\LEDAMA VPN NO ADDTIME\LEDAMA VPN SOCKS\\gradle\wrapper\gradle-wrapper.jar" org.gradle.wrapper.GradleWrapperMain
  2⤵
  PID:2588

memory/1968-6-0x0000000002740000-0x0000000005740000-memory.dmp

Filesize
48.0MB

Download
memory/1968-10-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1968-12-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2588-22-0x00000000025B0000-0x00000000055B0000-memory.dmp

Filesize
48.0MB

Download
memory/2588-24-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2588-26-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2588-34-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2588-45-0x00000000025B0000-0x00000000055B0000-memory.dmp

Filesize
48.0MB

Download
memory/2588-49-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download