5ccee64d7cda44cac1e1ebe9be61d2888c2d28dfa0c8cf0e255fe8b153cad342

Analysis

Target
CxZpMQSz.exe
Size 37KB
Sample220227-nyfnvsdeam
SHA256 5ccee64d7cda44cac1e1ebe9be61d2888c2d28dfa0c8cf0e255fe8b153cad342
MD5 4519b2d0617dcbb6d85ae78815e287c3
SHA1 88f0054d728f6ed03fd95c6304ff6a2357b2e8bf
SHA512 ae9c47cf3f4bd793256cad5deeee21f4c317e9e93fb10351779dce7f209f3d9d1407177295ba80aae4c947c829b317d5ada60b122f691a43ca218dea835fc8b0
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 4056	2552	CxZpMQSz.exe	57
PID 2552 wrote to memory of 4056	2552	CxZpMQSz.exe	57
PID 2552 wrote to memory of 4056	2552	CxZpMQSz.exe	57
PID 4056 wrote to memory of 3792	4056	fondue.exe	58
PID 4056 wrote to memory of 3792	4056	fondue.exe	58

C:\Users\Admin\AppData\Local\Temp\CxZpMQSz.exe
"C:\Users\Admin\AppData\Local\Temp\CxZpMQSz.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:3792