0db9ac02645846b5033b403a818544371046214bfedef7e70d44f5f825713c00 | Triage

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 08:59

Sharing

Report Analysis Logs

General

Target

rime-install.bat
Size

10KB
MD5

e66b05c5be11e99ae6da714ee1a09fc4
SHA1

b984b31f6e7cc9d4bd5bf0c4f75399218da9387b
SHA256

13687b87072f72cd9ca3813cbf6857375d8f6c472387c44a1ff2f4d16d58947c
SHA512

6976030e669af5389c4dfa9929c85f341910cbe65264a7317d64bd0c1f4fa6dcd605bde20322a5a498c3499ea79cd7a0176fd5547284da8785285c13b7de08dd
SSDEEP

192:M24/vL2Bbn0a+vx0ADv5vPDRiO6QvDkBt4yUFWDeYUWCP+DvJvOzSknbk:F4cnX/0dRiO6XCFWexWYIJGjk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2500	2980	cmd.exe	29
PID 2980 wrote to memory of 2500	2980	cmd.exe	29
PID 2980 wrote to memory of 2500	2980	cmd.exe	29
PID 2980 wrote to memory of 1700	2980	cmd.exe	30
PID 2980 wrote to memory of 1700	2980	cmd.exe	30
PID 2980 wrote to memory of 1700	2980	cmd.exe	30
PID 2980 wrote to memory of 2496	2980	cmd.exe	31
PID 2980 wrote to memory of 2496	2980	cmd.exe	31
PID 2980 wrote to memory of 2496	2980	cmd.exe	31
PID 2980 wrote to memory of 2044	2980	cmd.exe	32
PID 2980 wrote to memory of 2044	2980	cmd.exe	32
PID 2980 wrote to memory of 2044	2980	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\rime-install.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\system32\where.exe
  where /q 7z
  2⤵
  PID:2500
- C:\Windows\system32\where.exe
  where /q git
  2⤵
  PID:1700
- C:\Windows\system32\where.exe
  where /q bash
  2⤵
  PID:2496
- C:\Windows\system32\where.exe
  where /q curl
  2⤵
  PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads