fe8b23ef1880acb970ddbb469dbce724ffdc61355440d8d805df8672b1e29a3e

Analysis

max time kernel
144s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 20:42

Target

K-MeleonCCFME0.089/components/appcomps.dll
Size

228KB
MD5

de5d5082278b5f000d9daf71f84cc40e
SHA1

5fbe51d9876138984c7b132a6092d70564825d41
SHA256

7cfe51b76ba672e1d75c9b12540e49e62bcb246d2b7226e79cf29075c441bd3f
SHA512

e5d94a17b740fe74746eb3eba1ecc8aeebc83f82c2d1cbc27376c5fe109c469a443fd25cc971c01af17b1341b1cb400ad7d5011b074ffeb360254a2758871fc8
SSDEEP

3072:Gs/hHmvPW8wC0qvicX2fJ27IeDJNjSVuuH8MVS/e79IC+iN5bm5xVxuOYVjp9bNv:BZb9coJ27PnoVcMx9+XWNPfuHrle/a

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3468 wrote to memory of 3012	3468	rundll32.exe	rundll32.exe
PID 3468 wrote to memory of 3012	3468	rundll32.exe	rundll32.exe
PID 3468 wrote to memory of 3012	3468	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\K-MeleonCCFME0.089\components\appcomps.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3468

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\K-MeleonCCFME0.089\components\appcomps.dll,#1
2⤵
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:228