a1d303b353df28ed366a8fc944d93cacf25f328d63e2b95c30b188410a6894df

Resubmissions

12/01/2024, 05:35

12/01/2024, 05:30

12/01/2024, 05:25

max time kernel
131s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 05:25

Target

全自动安装.exe
Size

72KB
MD5

e3a56ba7e5a9da5a9644e4b541737821
SHA1

e952e90438855ef0608f99ad4b91d1323e7b0008
SHA256

df2bb321578bd2a30fa4e6e6aec4f3da278fd8c7f9858da5f49fd8cb8a4f5e31
SHA512

63a6e042c77a053cec7b92df8f6fd602c826ceedb88798b84e80eb10a72661b0fb3996fdc3a5559e741fba889de7968b4ee765cb0e0cf9f3eaa5408b6e990611
SSDEEP

1536:LrPJVKjbcknWSOYvTfkWkFM79yQVEzET5Xy27YzlL2WRFc:LLJMjbcHDdMwQ4s7YxLjR

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral12/memory/2184-0-0x0000000140000000-0x000000014002F000-memory.dmp	upx
behavioral12/memory/2184-6-0x0000000140000000-0x000000014002F000-memory.dmp	upx

Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs

pid	Process
2064	adb.exe
2808	adb.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2156	2184	全自动安装.exe	29
PID 2184 wrote to memory of 2156	2184	全自动安装.exe	29
PID 2184 wrote to memory of 2156	2184	全自动安装.exe	29
PID 2156 wrote to memory of 2064	2156	cmd.exe	30
PID 2156 wrote to memory of 2064	2156	cmd.exe	30
PID 2156 wrote to memory of 2064	2156	cmd.exe	30
PID 2156 wrote to memory of 2064	2156	cmd.exe	30
PID 2064 wrote to memory of 2148	2064	adb.exe	31
PID 2064 wrote to memory of 2148	2064	adb.exe	31
PID 2064 wrote to memory of 2148	2064	adb.exe	31
PID 2064 wrote to memory of 2148	2064	adb.exe	31
PID 2156 wrote to memory of 2808	2156	cmd.exe	32
PID 2156 wrote to memory of 2808	2156	cmd.exe	32
PID 2156 wrote to memory of 2808	2156	cmd.exe	32
PID 2156 wrote to memory of 2808	2156	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\全自动安装.exe
"C:\Users\Admin\AppData\Local\Temp\全自动安装.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3543.tmp\3544.tmp\3555.bat C:\Users\Admin\AppData\Local\Temp\全自动安装.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Users\Admin\AppData\Local\Temp\adb\adb.exe
    "adb\adb.exe" install "com.anagan.qgp.apk"
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\adb\adb.exe
      adb -L tcp:5037 fork-server server --reply-fd 240
      4⤵
      PID:2148
- - C:\Users\Admin\AppData\Local\Temp\adb\adb.exe
    "adb\adb.exe" kill-server
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2808

C:\Users\Admin\AppData\Local\Temp\3543.tmp\3544.tmp\3555.bat

Filesize
435B

MD5
2f68a3064dcbc3c25ed677cf9f8b3729

SHA1
9fad2e5c9752ec30cd32f2f7c23cb5a52566766a

SHA256
0a423e84702d81e85c2a8313fc0ea261ccb61ce1f255c1955f72505b76646163

SHA512
3782942518bb897455c5435892b732af8ef487cbe5799f0e3c20e28d76d4f619d51c09f2f17a1be3a7a509344f5050d82dd2aa7a64d961a8281f7843fa1c615b

Download Submit
memory/2184-0-0x0000000140000000-0x000000014002F000-memory.dmp

Filesize
188KB

Download
memory/2184-6-0x0000000140000000-0x000000014002F000-memory.dmp

Filesize
188KB

Download