e86224ab93aff0188e5deb93f041cc4ee9d47b65e4d51d61279982901b9800cc

Analysis

max time kernel
1561s
max time network
1563s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 05:14

Target
Tool_Files/ADB Tools.cmd
Size 10KB
Sample240615-fxc8cazcqa
SHA256 634e2bada6c6b7fb5a1e91342f816fbba994de49f95c98d8f732de0fede4c973
MD5 668bb0127ca2ace980272070018f730f
SHA1 7e52565de161efca60d4fad1efa2d684fe0da013
SHA512 c92938313ca1047f6a96b1e4b8d4534bf5aeb35508cdfd2fdbf3028b233a952d78112a61fb520960db433ef585ce7c411792e1b4ebc2d283f5c855b5d00b6ffb
SSDEEP 96:Pn3o3o3o3opmy5o8o3o3o3o3pA5kpxL9ef2aVcIxc3wVcd8wPKsFpYO4F8dfvXsG:1a5kpZ9Yf+Iig+d8A4kXsoZ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1196	2176	cmd.exe	29
PID 2176 wrote to memory of 1196	2176	cmd.exe	29
PID 2176 wrote to memory of 1196	2176	cmd.exe	29
PID 2176 wrote to memory of 1780	2176	cmd.exe	30
PID 2176 wrote to memory of 1780	2176	cmd.exe	30
PID 2176 wrote to memory of 1780	2176	cmd.exe	30
PID 2176 wrote to memory of 1720	2176	cmd.exe	31
PID 2176 wrote to memory of 1720	2176	cmd.exe	31
PID 2176 wrote to memory of 1720	2176	cmd.exe	31
PID 2176 wrote to memory of 2108	2176	cmd.exe	32
PID 2176 wrote to memory of 2108	2176	cmd.exe	32
PID 2176 wrote to memory of 2108	2176	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Tool_Files\ADB Tools.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %b in (1) do rem"
  2⤵
  PID:1196
- C:\Windows\system32\findstr.exe
  findstr /v /a:0a /R "^$" " BELOW IS YOUR DEVICE STATUS" nul
  2⤵
  PID:1780
- C:\Windows\system32\findstr.exe
  findstr /v /a:0a /R "^$" "----------------------------------------------------------------------------------------------------" nul
  2⤵
  PID:1720
- C:\Windows\system32\findstr.exe
  findstr /v /a:0a /R "^$" "----------------------------------------------------------------------------------------------------" nul
  2⤵
  PID:2108

BELOW IS YOUR DEVICE STATUS

Path C:\Users\Admin\AppData\Local\Temp\Tool_Files\ BELOW IS YOUR DEVICE STATUS
Size 3B
SHA256 3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351
MD5 df66fa563a2fafdb93cc559deb0a38c4
SHA1 e6666cf8574b0f7a9ae5bccee572f965c2aec9cb
SHA512 34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18
MD5 SHA1 SHA512

Submit Download