a182db438c03d54df11bf4fae1ab523bb05e5d07019e09720d6459d888e7e5c8

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 09:16

Target

rime-install.bat
Size

10KB
MD5

5aa301fd1b89986dc0cdde100be99338
SHA1

53766c257b359651d6b85dde96b2a6bc852f6918
SHA256

889cdcd779a158c71e5a08bc313553adf60867c300672ad7c5fd141ea221b23a
SHA512

25bd7a77904922d273c8fe648629d8dcfec91fd3539ee1a5a92cbf93045ecbb45cc1afe15a95a583ad183cbf0e1acce8507ea342c93235d6a35fe30de0b4a048
SSDEEP

192:M24/vL2Bbn0a+vx0ADv5vPDRiO6QvDkBt4yUFWDeGUWCP+DvJvOzSknbk:F4cnX/0dRiO6XCFWePWYIJGjk

Score

1^/10

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2380	1812	cmd.exe	29
PID 1812 wrote to memory of 2380	1812	cmd.exe	29
PID 1812 wrote to memory of 2380	1812	cmd.exe	29
PID 2380 wrote to memory of 2888	2380	cmd.exe	30
PID 2380 wrote to memory of 2888	2380	cmd.exe	30
PID 2380 wrote to memory of 2888	2380	cmd.exe	30
PID 1812 wrote to memory of 2332	1812	cmd.exe	31
PID 1812 wrote to memory of 2332	1812	cmd.exe	31
PID 1812 wrote to memory of 2332	1812	cmd.exe	31
PID 1812 wrote to memory of 2028	1812	cmd.exe	32
PID 1812 wrote to memory of 2028	1812	cmd.exe	32
PID 1812 wrote to memory of 2028	1812	cmd.exe	32
PID 1812 wrote to memory of 2672	1812	cmd.exe	33
PID 1812 wrote to memory of 2672	1812	cmd.exe	33
PID 1812 wrote to memory of 2672	1812	cmd.exe	33
PID 1812 wrote to memory of 3004	1812	cmd.exe	34
PID 1812 wrote to memory of 3004	1812	cmd.exe	34
PID 1812 wrote to memory of 3004	1812	cmd.exe	34

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\rime-install.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKEY_CURRENT_USER\SOFTWARE\Rime\Weasel" /v "RimeUserDir"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\system32\reg.exe
    reg query "HKEY_CURRENT_USER\SOFTWARE\Rime\Weasel" /v "RimeUserDir"
    3⤵
    PID:2888
- C:\Windows\system32\where.exe
  where /q 7z
  2⤵
  PID:2332
- C:\Windows\system32\where.exe
  where /q git
  2⤵
  PID:2028
- C:\Windows\system32\where.exe
  where /q bash
  2⤵
  PID:2672
- C:\Windows\system32\where.exe
  where /q curl
  2⤵
  PID:3004