00cce61c4924e9091dca2cfac372d872c30da56ead2803d1644f440e1f7d4b11

Analysis

Target
00cce61c4924e9091dca2cfac372d872c30da56ead2803d1644f440e1f7d4b11.exe
Size 552KB
Sample220223-bza4jsgcf6
SHA256 00cce61c4924e9091dca2cfac372d872c30da56ead2803d1644f440e1f7d4b11
MD5 4cb351e8852a562b71cbf68e9268e57c
SHA1 fc360475e4dd8e85c45cff54231b24c00a07f6ca
SHA512 d96dd4731251d1f5ad9ff7960d7aa0b06d32e207b830ccc65df48be1de7a970442fb3b1ebfb152bfaabb0082607f7252b1803585176a7058e492a76968476ae6
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2592	2572	00cce61c4924e9091dca2cfac372d872c30da56ead2803d1644f440e1f7d4b11.exe	71
PID 2572 wrote to memory of 2592	2572	00cce61c4924e9091dca2cfac372d872c30da56ead2803d1644f440e1f7d4b11.exe	71
PID 2572 wrote to memory of 2592	2572	00cce61c4924e9091dca2cfac372d872c30da56ead2803d1644f440e1f7d4b11.exe	71
PID 2592 wrote to memory of 2500	2592	fondue.exe	77
PID 2592 wrote to memory of 2500	2592	fondue.exe	77

C:\Users\Admin\AppData\Local\Temp\00cce61c4924e9091dca2cfac372d872c30da56ead2803d1644f440e1f7d4b11.exe
"C:\Users\Admin\AppData\Local\Temp\00cce61c4924e9091dca2cfac372d872c30da56ead2803d1644f440e1f7d4b11.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:2500