fe8b23ef1880acb970ddbb469dbce724ffdc61355440d8d805df8672b1e29a3e

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 20:42

Target

K-MeleonCCFME0.089/components/autoconfig.dll
Size

19KB
MD5

135cb1d3dd46f4a450e0484a9385b843
SHA1

27a4101d429fed14c2be21d6ac2bb23968874ca4
SHA256

3f4324524c811447490b46f92e58db734e8d36a85d75bdd895270d8e8b69e12b
SHA512

3716a95a9ddfcb0fb200204f3630a02cb45cf67992700ad6a3a2ceccd95c024dc7f48f8d696411e5865777d3135989a93f0c61b9132491c121a45a371d946716
SSDEEP

384:JvENEtOFHssRLMO+/rplIdfsi4f9izkfls3j4I1W1Sln1k/SmbI14K:BoEkRB+/klEmj4I1W1Sln18du

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3500 wrote to memory of 4056	3500	rundll32.exe	rundll32.exe
PID 3500 wrote to memory of 4056	3500	rundll32.exe	rundll32.exe
PID 3500 wrote to memory of 4056	3500	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\K-MeleonCCFME0.089\components\autoconfig.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3500

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\K-MeleonCCFME0.089\components\autoconfig.dll,#1
2⤵
PID:4056