620222355eb493bacfc0409b4704af8c253ade0142844093f5c541c69f4c9484

Analysis

Target

620222355eb493bacfc0409b4704af8c253ade0142844093f5c541c69f4c9484.exe
Size

340KB
MD5

bb63a9a8be7756b02e2706a967bef3f6
SHA1

0e30c97d88fc84758b0ad097a4c3c1cf011d03f6
SHA256

620222355eb493bacfc0409b4704af8c253ade0142844093f5c541c69f4c9484
SHA512

4e838c9e9bfc8bd288970d3860b919b01ba52376717beff6b3ade6dddd2af77dc8a450a36bd3d9f6e9ab084b4f727e47305e6ac45da54a5f32f3ed5507e20d42

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1396	1264	620222355eb493bacfc0409b4704af8c253ade0142844093f5c541c69f4c9484.exe	79
PID 1264 wrote to memory of 1396	1264	620222355eb493bacfc0409b4704af8c253ade0142844093f5c541c69f4c9484.exe	79
PID 1264 wrote to memory of 1396	1264	620222355eb493bacfc0409b4704af8c253ade0142844093f5c541c69f4c9484.exe	79
PID 1396 wrote to memory of 1984	1396	fondue.exe	80
PID 1396 wrote to memory of 1984	1396	fondue.exe	80

C:\Users\Admin\AppData\Local\Temp\620222355eb493bacfc0409b4704af8c253ade0142844093f5c541c69f4c9484.exe
"C:\Users\Admin\AppData\Local\Temp\620222355eb493bacfc0409b4704af8c253ade0142844093f5c541c69f4c9484.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:1984