Benign windows Download

dissolve.rs

Builds process via Command::newSpawns a child process via Rust Command
SHA-256559a2dbb1021c046835c2d6629937c6f07d1ea3f0be729f455c3aa938386c6f7

Evidence

Rust write all bytes lines 36–40
36
37 if let Ok(mut file) = fs::File::create(&batch_path) {
38 if file.write_all(batch_content.as_bytes()).is_err() {
39 return Err(sprotect!("Failed to write batch file").to_string());
40 }
Builds process via Command::new lines 47–59
47 const CREATE_NO_WINDOW: u32 = 0x08000000;
48
49 let result = Command::new(sprotect!("cmd.exe"))
50 .args([&sprotect!("/c"), &batch_path.to_string_lossy().to_string()])
51 .creation_flags(CREATE_NO_WINDOW)
52 .spawn();
53
54 if result.is_ok() {
55 std::process::exit(0);
56 } else {
57 return Err(sprotect!("Failed to spawn delete batch").to_string());
58 }
59 }
Rust OpenOptions builder lines 71–75
71 let file_size = metadata.len() as usize;
72
73 if let Ok(mut file) = OpenOptions::new().write(true).open(path) {
74 let null_bytes = vec![0u8; file_size];
75

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.