199879ac19872d6b0ff820d8f502062f0efea37867b937dc04580cf170b8228d

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 06:54

Target

JIGUtility_V2.0.8.0_20230112/ASUSR_ParsingRecord/ASUSR_ParsingRecord/ASUSEPS.cmd
Size

1KB
MD5

6ea3a1d6aca8845842e63c3c3aac62a1
SHA1

b46fa37068e3b1352f7559f9a5e5679d8115416e
SHA256

2b3a65d439fd1e341d797ed1934165e9fd019aac4b2c827f2118d621662633b9
SHA512

522103c03c61d77666d3c43397f5520b3255ebc0c7fd80d5a411e56dfa81f174279f574d54a3b65a156069b8ab5fb7bbe91f6e7e2d23725190fbe2afca49713d

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	Process	procid_target
PID 2660 wrote to memory of 2536	2660	cmd.exe	85
PID 2660 wrote to memory of 2536	2660	cmd.exe	85
PID 2660 wrote to memory of 2536	2660	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JIGUtility_V2.0.8.0_20230112\ASUSR_ParsingRecord\ASUSR_ParsingRecord\ASUSEPS.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Local\Temp\JIGUtility_V2.0.8.0_20230112\ASUSR_ParsingRecord\ASUSR_ParsingRecord\ASUSR_ParsingRecord.exe
  .\ASUSR_ParsingRecord.exe /test_type /filename /jb_hw_version /jb_fw_version /jb_utility_ap_version /SN /ISN_NO /test_time /jb_bios_ver /jb_bios_update_time /jb_bios_update_result -a
  2⤵
  PID:2536