7ae05c4164362a9072cf5c30d13f9f0ef8840aac009d976b05c7b05f2a905e07 | Triage

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 12:55

Sharing

Report Analysis Logs

General

Target

u960_recovery_5.0.2.7_c4_cn/安装recovery_adb_root.bat
Size

1KB
MD5

956fbc475909c893ae08a26f0af7e2a5
SHA1

36ffab5d36e9127f946addb166933c3a83f40040
SHA256

eeee5e8e83ff8a023a4212e2b30f31b85d455b8774155e5707507751de08348a
SHA512

ec37b91963aa93f26c9c80e6e75aa612c857d40f536c31840152af0b61527bde77c11f3142cc98ea2d853ceae2189cfacf2248e09b83bd6b380b439befaa8aa3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 4012	3512	cmd.exe	19
PID 3512 wrote to memory of 4012	3512	cmd.exe	19
PID 3512 wrote to memory of 4012	3512	cmd.exe	19

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\u960_recovery_5.0.2.7_c4_cn\安装recovery_adb_root.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Users\Admin\AppData\Local\Temp\u960_recovery_5.0.2.7_c4_cn\files\adb.exe
  files\adb kill-server
  2⤵
  PID:4012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4012-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download