7ae05c4164362a9072cf5c30d13f9f0ef8840aac009d976b05c7b05f2a905e07 | Triage

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 12:55

Sharing

Report Analysis Logs

General

Target

u960_recovery_5.0.2.7_c4_cn/直接启动到recovery.bat
Size

472B
MD5

e341d705e68739d7b145625f2b92a3a8
SHA1

0b2e0b1dc8f03d963daca66d7f6aacd626328188
SHA256

3bb94a13f78a15798907d3cf7aafb7a8e61ecbdd109c9ce876312f6f2394865d
SHA512

43f739d79e8456b5cc71003841c46b7673eb6a531c7f94681d634a0ad9af14007e93851ad49ab3256a38f52d0b6e66c7b20a0ed5b2b71a45db47f13aa6065ed5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 3040	4976	cmd.exe	88
PID 4976 wrote to memory of 3040	4976	cmd.exe	88
PID 4976 wrote to memory of 3040	4976	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\u960_recovery_5.0.2.7_c4_cn\直接启动到recovery.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Users\Admin\AppData\Local\Temp\u960_recovery_5.0.2.7_c4_cn\files\adb.exe
  files\adb kill-server
  2⤵
  PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download