549ebde3daa59c044fc725c988ceced294da49053f723f31cae3a0bf9c7aa93b

Analysis

Target

549ebde3daa59c044fc725c988ceced294da49053f723f31cae3a0bf9c7aa93b.exe
Size

900KB
MD5

ca9bbaa73bae25efa936a5ec3c5544ee
SHA1

08370270d030793c166fea22ad903a4554aee3d6
SHA256

549ebde3daa59c044fc725c988ceced294da49053f723f31cae3a0bf9c7aa93b
SHA512

014b3ba273841b2d131d1ec0c12a277b89429dedc108531527114bebf4840c95faf95983d6f0ee7a21fbadf6365cfcde764d586094bb4a92b17d259982df34f1

Score

4^/10

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	816	svchost.exe
Token: SeCreatePagefilePrivilege	816	svchost.exe
Token: SeShutdownPrivilege	816	svchost.exe
Token: SeCreatePagefilePrivilege	816	svchost.exe
Token: SeShutdownPrivilege	816	svchost.exe
Token: SeCreatePagefilePrivilege	816	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

549ebde3daa59c044fc725c988ceced294da49053f723f31cae3a0bf9c7aa93b.exefondue.exe

description	pid	process	target process
PID 2764 wrote to memory of 2596	2764	549ebde3daa59c044fc725c988ceced294da49053f723f31cae3a0bf9c7aa93b.exe	fondue.exe
PID 2764 wrote to memory of 2596	2764	549ebde3daa59c044fc725c988ceced294da49053f723f31cae3a0bf9c7aa93b.exe	fondue.exe
PID 2764 wrote to memory of 2596	2764	549ebde3daa59c044fc725c988ceced294da49053f723f31cae3a0bf9c7aa93b.exe	fondue.exe
PID 2596 wrote to memory of 3080	2596	fondue.exe	FonDUE.EXE
PID 2596 wrote to memory of 3080	2596	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\549ebde3daa59c044fc725c988ceced294da49053f723f31cae3a0bf9c7aa93b.exe
"C:\Users\Admin\AppData\Local\Temp\549ebde3daa59c044fc725c988ceced294da49053f723f31cae3a0bf9c7aa93b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2764

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:3080

memory/816-130-0x000002220BD30000-0x000002220BD40000-memory.dmp

Filesize
64KB

Download
memory/816-131-0x000002220BD90000-0x000002220BDA0000-memory.dmp

Filesize
64KB

Download
memory/816-132-0x000002220EA90000-0x000002220EA94000-memory.dmp

Filesize
16KB

Download