a1d303b353df28ed366a8fc944d93cacf25f328d63e2b95c30b188410a6894df

Resubmissions

12/01/2024, 05:35

12/01/2024, 05:30

12/01/2024, 05:25

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-es
resource tags

arch:x64arch:x86image:win10v2004-20231215-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
12/01/2024, 05:30

Target

全自动安装.exe
Size

72KB
MD5

e3a56ba7e5a9da5a9644e4b541737821
SHA1

e952e90438855ef0608f99ad4b91d1323e7b0008
SHA256

df2bb321578bd2a30fa4e6e6aec4f3da278fd8c7f9858da5f49fd8cb8a4f5e31
SHA512

63a6e042c77a053cec7b92df8f6fd602c826ceedb88798b84e80eb10a72661b0fb3996fdc3a5559e741fba889de7968b4ee765cb0e0cf9f3eaa5408b6e990611
SSDEEP

1536:LrPJVKjbcknWSOYvTfkWkFM79yQVEzET5Xy27YzlL2WRFc:LLJMjbcHDdMwQ4s7YxLjR

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral7/memory/4800-0-0x0000000140000000-0x000000014002F000-memory.dmp	upx
behavioral7/memory/4800-6-0x0000000140000000-0x000000014002F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3076	4800	全自动安装.exe	89
PID 4800 wrote to memory of 3076	4800	全自动安装.exe	89
PID 3076 wrote to memory of 3980	3076	cmd.exe	91
PID 3076 wrote to memory of 3980	3076	cmd.exe	91
PID 3076 wrote to memory of 3980	3076	cmd.exe	91
PID 3980 wrote to memory of 2844	3980	adb.exe	96
PID 3980 wrote to memory of 2844	3980	adb.exe	96
PID 3980 wrote to memory of 2844	3980	adb.exe	96
PID 3076 wrote to memory of 2676	3076	cmd.exe	99
PID 3076 wrote to memory of 2676	3076	cmd.exe	99
PID 3076 wrote to memory of 2676	3076	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\全自动安装.exe
"C:\Users\Admin\AppData\Local\Temp\全自动安装.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6EE6.tmp\6EE7.tmp\6EE8.bat C:\Users\Admin\AppData\Local\Temp\全自动安装.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Users\Admin\AppData\Local\Temp\adb\adb.exe
    "adb\adb.exe" install "com.anagan.qgp.apk"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\adb\adb.exe
      adb -L tcp:5037 fork-server server --reply-fd 600
      4⤵
      PID:2844
- - C:\Users\Admin\AppData\Local\Temp\adb\adb.exe
    "adb\adb.exe" kill-server
    3⤵
    PID:2676

C:\Users\Admin\AppData\Local\Temp\6EE6.tmp\6EE7.tmp\6EE8.bat

Filesize
435B

MD5
2f68a3064dcbc3c25ed677cf9f8b3729

SHA1
9fad2e5c9752ec30cd32f2f7c23cb5a52566766a

SHA256
0a423e84702d81e85c2a8313fc0ea261ccb61ce1f255c1955f72505b76646163

SHA512
3782942518bb897455c5435892b732af8ef487cbe5799f0e3c20e28d76d4f619d51c09f2f17a1be3a7a509344f5050d82dd2aa7a64d961a8281f7843fa1c615b

Download Submit
memory/4800-0-0x0000000140000000-0x000000014002F000-memory.dmp

Filesize
188KB

Download
memory/4800-6-0x0000000140000000-0x000000014002F000-memory.dmp

Filesize
188KB

Download