b3da01b83eb9ba4fc8a3fa2996dfbdc1bb185709b6998d72dd59490b1040d53b

Analysis

Target

b3da01b83eb9ba4fc8a3fa2996dfbdc1bb185709b6998d72dd59490b1040d53b.exe
Size

7.5MB
MD5

17808fde8c7e2d1a6f9cbdfd1c1c628c
SHA1

1f30f5c18d6fe8322fd67d311043771fffc52c61
SHA256

b3da01b83eb9ba4fc8a3fa2996dfbdc1bb185709b6998d72dd59490b1040d53b
SHA512

637d20ad9914de591640e9e89b9099793cc40bb16e488587dd4f4b4a56c6171d268f1a55b0d889a5b83cf2fa369d5331afb2e46f7f6cea3ec4a680e123db8dcf

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

b3da01b83eb9ba4fc8a3fa2996dfbdc1bb185709b6998d72dd59490b1040d53b.exefondue.exe

description	pid	process	target process
PID 4456 wrote to memory of 3244	4456	b3da01b83eb9ba4fc8a3fa2996dfbdc1bb185709b6998d72dd59490b1040d53b.exe	fondue.exe
PID 4456 wrote to memory of 3244	4456	b3da01b83eb9ba4fc8a3fa2996dfbdc1bb185709b6998d72dd59490b1040d53b.exe	fondue.exe
PID 4456 wrote to memory of 3244	4456	b3da01b83eb9ba4fc8a3fa2996dfbdc1bb185709b6998d72dd59490b1040d53b.exe	fondue.exe
PID 3244 wrote to memory of 1632	3244	fondue.exe	FonDUE.EXE
PID 3244 wrote to memory of 1632	3244	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\b3da01b83eb9ba4fc8a3fa2996dfbdc1bb185709b6998d72dd59490b1040d53b.exe
"C:\Users\Admin\AppData\Local\Temp\b3da01b83eb9ba4fc8a3fa2996dfbdc1bb185709b6998d72dd59490b1040d53b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:1632