518c5a69231dc87391896be44c5f7c9d36ec375d4c2878b6783869cce8da1133

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 13:02

Target

SuperOneClickv1.5.5/SuperOneClickv1.5.5/2.安装visionary+.bat
Size

27B
MD5

eb3d2fa2f4292efd8d0f27af9f72e74f
SHA1

40512bf2961cd3c35e749956e18ee2a87ca5a118
SHA256

5e23d176e10bcd4aa429a5eabf01be10c53e038869320058716685aa46ecf836
SHA512

d82829d403ef4a76f43e7e077941c4cdf61ebd52f1d457489b6aae96b3d2e89dfded213de4bd327310a6aa2d31fcb253b63ed7fc8eecb6f88e5eb096ec1e9c2e

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 3764	3320	cmd.exe	20
PID 3320 wrote to memory of 3764	3320	cmd.exe	20
PID 3320 wrote to memory of 3764	3320	cmd.exe	20
PID 3764 wrote to memory of 4712	3764	adb.exe	94
PID 3764 wrote to memory of 4712	3764	adb.exe	94
PID 3764 wrote to memory of 4712	3764	adb.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SuperOneClickv1.5.5\SuperOneClickv1.5.5\2.安装visionary+.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Users\Admin\AppData\Local\Temp\SuperOneClickv1.5.5\SuperOneClickv1.5.5\adb.exe
  adb install root.apk
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Users\Admin\AppData\Local\Temp\SuperOneClickv1.5.5\SuperOneClickv1.5.5\adb.exe
    adb fork-server server
    3⤵
    PID:4712