7c9e308edff467528d167d0e4dfb7e17e61ba96ad413041b66c243869ef18721 | Triage

Analysis

max time kernel
100s
max time network
144s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
20-12-2024 13:39

Sharing

Report Analysis Logs

General

Target

apktool/apktool.bat
Size

135B
MD5

b02966b106045115fa8ef94a4e67537b
SHA1

f901df8bbfe8fe50e560e625a27da1c6c4f0e9b3
SHA256

3d8108beb40535e68e7f6421a4309408ea5efab91707fa25d862154e3cc9b6df
SHA512

6274a4568285c74985b095d1dd5649044b61cb7c372dc4653c62a2b92833df477f5a5453be0e598622918b4e6c27064a57e5fba1a657dd064e6d9598fe2f94cc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 4480	3348	cmd.exe	82
PID 3348 wrote to memory of 4480	3348	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\apktool\apktool.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar -Duser.language=en "C:\Users\Admin\AppData\Local\Temp\apktool\\apktool.jar"
  2⤵
  PID:4480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4480-2-0x0000018801DA0000-0x0000018802010000-memory.dmp

Filesize
2.4MB

Download
memory/4480-11-0x0000018801D80000-0x0000018801D81000-memory.dmp

Filesize
4KB

Download
memory/4480-14-0x0000018801D80000-0x0000018801D81000-memory.dmp

Filesize
4KB

Download
memory/4480-15-0x0000018801DA0000-0x0000018802010000-memory.dmp

Filesize
2.4MB

Download