7c9e308edff467528d167d0e4dfb7e17e61ba96ad413041b66c243869ef18721 | Triage

Analysis

max time kernel
95s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 13:47

Sharing

Report Analysis Logs

General

Target

apktool/apktool.bat
Size

135B
MD5

b02966b106045115fa8ef94a4e67537b
SHA1

f901df8bbfe8fe50e560e625a27da1c6c4f0e9b3
SHA256

3d8108beb40535e68e7f6421a4309408ea5efab91707fa25d862154e3cc9b6df
SHA512

6274a4568285c74985b095d1dd5649044b61cb7c372dc4653c62a2b92833df477f5a5453be0e598622918b4e6c27064a57e5fba1a657dd064e6d9598fe2f94cc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 4636	916	cmd.exe	83
PID 916 wrote to memory of 4636	916	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\apktool\apktool.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:916
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar -Duser.language=en "C:\Users\Admin\AppData\Local\Temp\apktool\\apktool.jar"
  2⤵
  PID:4636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4636-2-0x00000188429D0000-0x0000018842C40000-memory.dmp

Filesize
2.4MB

Download
memory/4636-11-0x0000018841120000-0x0000018841121000-memory.dmp

Filesize
4KB

Download
memory/4636-14-0x0000018841120000-0x0000018841121000-memory.dmp

Filesize
4KB

Download
memory/4636-15-0x00000188429D0000-0x0000018842C40000-memory.dmp

Filesize
2.4MB

Download