4605743d52d2ffb682496b88cd8d436ce03e878a822eac4b5c52d0d428f24c40

Analysis

max time kernel
153s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 16:08

Target

ICS_rooting/runit-win.bat
Size

1KB
MD5

a4970bf3bc94c53312919ebad0337b46
SHA1

3744e0aa7521b225187303b87a4379bfbf045dcf
SHA256

ee01fa2b28a8b71c81528d7b1e8d978766cf95b5769a05e9638a25f30d8d8345
SHA512

5523c18ac78cf3873151fe66c89121223ba54ebb32664e49e5f30ef852ab07a8176b007e9bd8d8c1de54dd42acfd0a63e8974afe329921a03bdb6507a73bec51

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 2028	3628	cmd.exe	89
PID 3628 wrote to memory of 2028	3628	cmd.exe	89
PID 3628 wrote to memory of 2028	3628	cmd.exe	89
PID 2028 wrote to memory of 4652	2028	adb.exe	93
PID 2028 wrote to memory of 4652	2028	adb.exe	93
PID 2028 wrote to memory of 4652	2028	adb.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ICS_rooting\runit-win.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Users\Admin\AppData\Local\Temp\ICS_rooting\adb.exe
  adb wait-for-device
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Users\Admin\AppData\Local\Temp\ICS_rooting\adb.exe
    adb fork-server server
    3⤵
    PID:4652

memory/2028-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4652-1-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4652-3-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4652-5-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4652-7-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download