7ae05c4164362a9072cf5c30d13f9f0ef8840aac009d976b05c7b05f2a905e07 | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 12:55

Sharing

Report Analysis Logs

General

Target

u960_recovery_5.0.2.7_c4_cn/安装recovery_adb_root.bat
Size

1KB
MD5

956fbc475909c893ae08a26f0af7e2a5
SHA1

36ffab5d36e9127f946addb166933c3a83f40040
SHA256

eeee5e8e83ff8a023a4212e2b30f31b85d455b8774155e5707507751de08348a
SHA512

ec37b91963aa93f26c9c80e6e75aa612c857d40f536c31840152af0b61527bde77c11f3142cc98ea2d853ceae2189cfacf2248e09b83bd6b380b439befaa8aa3

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1692	adb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 1692	2636	cmd.exe	29
PID 2636 wrote to memory of 1692	2636	cmd.exe	29
PID 2636 wrote to memory of 1692	2636	cmd.exe	29
PID 2636 wrote to memory of 1692	2636	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\u960_recovery_5.0.2.7_c4_cn\安装recovery_adb_root.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Users\Admin\AppData\Local\Temp\u960_recovery_5.0.2.7_c4_cn\files\adb.exe
  files\adb kill-server
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1692-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download