fe8b23ef1880acb970ddbb469dbce724ffdc61355440d8d805df8672b1e29a3e

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 20:42

Target

K-MeleonCCFME0.089/components/accessibility.dll
Size

212KB
MD5

83ee44e107fc719758e487bbbce3043d
SHA1

ae70d857cefe652179316ef45a96d03820fe0c61
SHA256

5b2384c606d99694b4d76153e46f7f7613aa4de9a334ed39895b1215c3d5c7ff
SHA512

7c858a2ba375bf2c369ec6d0688f01803d55b7ca492541dc6d3fe7980dfc8318fe88218e8eb8d75dfc33199c5462a76a0eceda62f5d7b33bb4d7bd5b8baa5fd9
SSDEEP

3072:pCb4KoL+sRklz5j/MaHZnR88DFcpCYiDSwjGDFkihhEGlmL:p97bRkXo8ZnRnD61iDfGqiy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2264 wrote to memory of 2620	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 2620	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 2620	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 2620	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 2620	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 2620	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 2620	2264	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\K-MeleonCCFME0.089\components\accessibility.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\K-MeleonCCFME0.089\components\accessibility.dll,#1
2⤵
PID:2620