7ae05c4164362a9072cf5c30d13f9f0ef8840aac009d976b05c7b05f2a905e07 | Triage

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 12:55

Sharing

Report Analysis Logs

General

Target

u960_recovery_5.0.2.7_c4_cn/安装recovery.bat
Size

1KB
MD5

9f692dae1af3ff3c975914696613b510
SHA1

7668f4629b7c6c32264f734be3e9fce6a79c17e1
SHA256

e2501b6c9a488485aa10720a36f4bf1e08e55c1802f0ef6dff7747b2cd94b3da
SHA512

a5afc7706d0c3b99fcd59ec017984f28afa40d2f61bf6ccc490637479733bb6a57d1cec3f01812178d42316ee2d66506b7540f9cce76db4c51274ca9206a79ae

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 4284	2300	cmd.exe	89
PID 2300 wrote to memory of 4284	2300	cmd.exe	89
PID 2300 wrote to memory of 4284	2300	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\u960_recovery_5.0.2.7_c4_cn\安装recovery.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Users\Admin\AppData\Local\Temp\u960_recovery_5.0.2.7_c4_cn\files\adb.exe
  files\adb kill-server
  2⤵
  PID:4284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4284-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download