3c5e0085adfb6d60d77aa3b3f4a8cf2e3beb1139de69d1f921c6e1017da16a9f

Resubmissions

02-04-2024 18:02

02-04-2024 17:49

max time kernel
1159s
max time network
1166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 18:02

Target

JIGUtility_V2.0.8.0_20230112/ASUSR_ParsingRecord/ASUSR_ParsingRecord/ASUSEPS.cmd
Size

1KB
MD5

6ea3a1d6aca8845842e63c3c3aac62a1
SHA1

b46fa37068e3b1352f7559f9a5e5679d8115416e
SHA256

2b3a65d439fd1e341d797ed1934165e9fd019aac4b2c827f2118d621662633b9
SHA512

522103c03c61d77666d3c43397f5520b3255ebc0c7fd80d5a411e56dfa81f174279f574d54a3b65a156069b8ab5fb7bbe91f6e7e2d23725190fbe2afca49713d

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	Process	procid_target
PID 3812 wrote to memory of 1268	3812	cmd.exe	85
PID 3812 wrote to memory of 1268	3812	cmd.exe	85
PID 3812 wrote to memory of 1268	3812	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JIGUtility_V2.0.8.0_20230112\ASUSR_ParsingRecord\ASUSR_ParsingRecord\ASUSEPS.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Users\Admin\AppData\Local\Temp\JIGUtility_V2.0.8.0_20230112\ASUSR_ParsingRecord\ASUSR_ParsingRecord\ASUSR_ParsingRecord.exe
  .\ASUSR_ParsingRecord.exe /test_type /filename /jb_hw_version /jb_fw_version /jb_utility_ap_version /SN /ISN_NO /test_time /jb_bios_ver /jb_bios_update_time /jb_bios_update_result -a
  2⤵
  PID:1268