518c5a69231dc87391896be44c5f7c9d36ec375d4c2878b6783869cce8da1133

Analysis

max time kernel
152s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 13:02

Target

SuperOneClickv1.5.5/SuperOneClickv1.5.5/1.push.bat
Size

104B
MD5

e2095ac4aeef2027f8267d308e55188b
SHA1

cc27a098e435ddeed2960fecc9f35f82269415f7
SHA256

d0be1f4a950cdd41d0f832c45b728a2e71bd428713d7fd724abd8a1f57626cb4
SHA512

93e811623b7b911f138baf86c9d2adaf41bd703f26c3decf97d211a48a1519511f0e5e191a2345771896289d7e47efc69db74fd299f6e998e37f7079aa143a1b

Score

1^/10

Suspicious behavior: CmdExeWriteProcessMemorySpam 3 IoCs

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2376	2304	cmd.exe	28
PID 2304 wrote to memory of 2376	2304	cmd.exe	28
PID 2304 wrote to memory of 2376	2304	cmd.exe	28
PID 2304 wrote to memory of 2376	2304	cmd.exe	28
PID 2376 wrote to memory of 2308	2376	adb.exe	29
PID 2376 wrote to memory of 2308	2376	adb.exe	29
PID 2376 wrote to memory of 2308	2376	adb.exe	29
PID 2376 wrote to memory of 2308	2376	adb.exe	29
PID 2304 wrote to memory of 2824	2304	cmd.exe	30
PID 2304 wrote to memory of 2824	2304	cmd.exe	30
PID 2304 wrote to memory of 2824	2304	cmd.exe	30
PID 2304 wrote to memory of 2824	2304	cmd.exe	30
PID 2304 wrote to memory of 2848	2304	cmd.exe	31
PID 2304 wrote to memory of 2848	2304	cmd.exe	31
PID 2304 wrote to memory of 2848	2304	cmd.exe	31
PID 2304 wrote to memory of 2848	2304	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SuperOneClickv1.5.5\SuperOneClickv1.5.5\1.push.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Local\Temp\SuperOneClickv1.5.5\SuperOneClickv1.5.5\adb.exe
  adb devices
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Users\Admin\AppData\Local\Temp\SuperOneClickv1.5.5\SuperOneClickv1.5.5\adb.exe
    adb fork-server server
    3⤵
    PID:2308
- C:\Users\Admin\AppData\Local\Temp\SuperOneClickv1.5.5\SuperOneClickv1.5.5\adb.exe
  adb push flash_image /data/local/flash_image
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2824
- C:\Users\Admin\AppData\Local\Temp\SuperOneClickv1.5.5\SuperOneClickv1.5.5\adb.exe
  adb push misc.img /data/local/misc.img
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2848