c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087

Analysis

Target
c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe
Size 386KB
Sample220308-g4c2laegen
SHA256 c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087
MD5 c797d7a9adbc5012b79487311efcfd1d
SHA1 b36e3f2f4baa0ff0409351b8e285787cbe19d1c1
SHA512 030c1e3b1fc676b03841dc758de7b76d1ad54c31883248cc3aea4db23b64507958c64bf771d3247149626eb5d7b7fdb3a0bbf2b5115cb31fc5088eff35866b02
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 3900	3048	c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe	78
PID 3048 wrote to memory of 3900	3048	c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe	78
PID 3048 wrote to memory of 3900	3048	c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe	78
PID 3900 wrote to memory of 4268	3900	fondue.exe	79
PID 3900 wrote to memory of 4268	3900	fondue.exe	79

C:\Users\Admin\AppData\Local\Temp\c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe
"C:\Users\Admin\AppData\Local\Temp\c9e25b31a594a4cb867bae75bfe9900405d1b2e00eb231e3588da6e4319e0087.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:4268