39ca8f9968b34c7262a5cd169e55959351c68a094983ea537b54e555be87d685

Analysis

Target

39ca8f9968b34c7262a5cd169e55959351c68a094983ea537b54e555be87d685.exe
Size

340KB
MD5

445ceb67566b9baadce86dea15d48026
SHA1

2ce8fccfec4a063cb153cc0d0d539612e14ba1a3
SHA256

39ca8f9968b34c7262a5cd169e55959351c68a094983ea537b54e555be87d685
SHA512

dcc02495e096f2fd7d057e6c84c521541cc18e1756dd6599cb66a5c76076db6f2c6961395ebc08c43a876fc792a301635c6ea9b3ab9f8f082d4abb9abcbc687c

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 2428	3368	39ca8f9968b34c7262a5cd169e55959351c68a094983ea537b54e555be87d685.exe	54
PID 3368 wrote to memory of 2428	3368	39ca8f9968b34c7262a5cd169e55959351c68a094983ea537b54e555be87d685.exe	54
PID 3368 wrote to memory of 2428	3368	39ca8f9968b34c7262a5cd169e55959351c68a094983ea537b54e555be87d685.exe	54
PID 2428 wrote to memory of 464	2428	fondue.exe	55
PID 2428 wrote to memory of 464	2428	fondue.exe	55

C:\Users\Admin\AppData\Local\Temp\39ca8f9968b34c7262a5cd169e55959351c68a094983ea537b54e555be87d685.exe
"C:\Users\Admin\AppData\Local\Temp\39ca8f9968b34c7262a5cd169e55959351c68a094983ea537b54e555be87d685.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:464