fe8b23ef1880acb970ddbb469dbce724ffdc61355440d8d805df8672b1e29a3e | Triage

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 20:42

Sharing

Report Analysis Logs

General

Target

K-MeleonCCFME0.089/components/appshell.dll
Size

68KB
MD5

f5d5d5a5537fb02d5a7407e23b393fef
SHA1

4a76d74c9bf15f4b47a9db3c0d6e6445577eaf2d
SHA256

493b518d5233c06a7dd8b8a16824662ec21893980132479bcf68eb7bad7f9248
SHA512

54fbad16b3bf077c0fd089b03744611e9dd59b2577392035b5e469667e52316ab1128acb8855a36b6154d318e0075a83f1f78bb4f654571a9cc7641aa9110561
SSDEEP

1536:RXPzYnkTsoVutWFJ+Nxk1jNMkfvGOs/F55:RXbYkTslWFJ+NxJ6vwd7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2216 wrote to memory of 1736	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 1736	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 1736	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 1736	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 1736	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 1736	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 1736	2216	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\K-MeleonCCFME0.089\components\appshell.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\K-MeleonCCFME0.089\components\appshell.dll,#1
2⤵
PID:1736

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...