4a535a8d28c96abbffe577b8fbe42eb2ff578e86ad52e82d3a32614ff70e3579

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 13:55

Target

KingRoot PC 1.5Beta/install-root.bat
Size

255B
MD5

b4c8c9780429b6e66875849b7f9bfaca
SHA1

23bb0fc1ea3de918789c95d98efa563571633b35
SHA256

8a9846b37e85e0cae2a450e020d4019f6d92110f6f6712afd1238127eb96e400
SHA512

7020379fac2435caeda41a5f27865cb36f38681a564dfb284c99a48f3e0bc697b8fe41f60bbe3eca1e134d05d39e443ccafef4e5d6559c8e0a267805ddd5c849

Score

1^/10

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2872	adb.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2872	3000	cmd.exe	29
PID 3000 wrote to memory of 2872	3000	cmd.exe	29
PID 3000 wrote to memory of 2872	3000	cmd.exe	29
PID 3000 wrote to memory of 2872	3000	cmd.exe	29
PID 2872 wrote to memory of 3068	2872	adb.exe	30
PID 2872 wrote to memory of 3068	2872	adb.exe	30
PID 2872 wrote to memory of 3068	2872	adb.exe	30
PID 2872 wrote to memory of 3068	2872	adb.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\KingRoot PC 1.5Beta\install-root.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\KingRoot PC 1.5Beta\adb.exe
  adb wait-for-device
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\KingRoot PC 1.5Beta\adb.exe
    adb fork-server server
    3⤵
    PID:3068

memory/2872-0-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3068-1-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3068-3-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download