b3e74c6905d76cc0049d6677166c49dff46ff27ddf309a5a78c191fef9e4a811

Analysis

Target
b3e74c6905d76cc0049d6677166c49dff46ff27ddf309a5a78c191fef9e4a811.exe
Size 552KB
Sample220311-1lbklaeeep
SHA256 b3e74c6905d76cc0049d6677166c49dff46ff27ddf309a5a78c191fef9e4a811
MD5 c514aa2734caaed67ec3164823482df8
SHA1 b98c1b7ade50b3337eee9ab0425e5d9b07f7f3cd
SHA512 cbe028f578e5a7c6b51638f45f04444063acae039bb2b0e1046e03ad1f73118a96b548d6fdc1c3b8961f6f811427b0b77a9a66a531a2eed0ca23f9b8d7c0e6b5
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 408	4084	b3e74c6905d76cc0049d6677166c49dff46ff27ddf309a5a78c191fef9e4a811.exe	80
PID 4084 wrote to memory of 408	4084	b3e74c6905d76cc0049d6677166c49dff46ff27ddf309a5a78c191fef9e4a811.exe	80
PID 4084 wrote to memory of 408	4084	b3e74c6905d76cc0049d6677166c49dff46ff27ddf309a5a78c191fef9e4a811.exe	80
PID 408 wrote to memory of 3540	408	fondue.exe	81
PID 408 wrote to memory of 3540	408	fondue.exe	81

C:\Users\Admin\AppData\Local\Temp\b3e74c6905d76cc0049d6677166c49dff46ff27ddf309a5a78c191fef9e4a811.exe
"C:\Users\Admin\AppData\Local\Temp\b3e74c6905d76cc0049d6677166c49dff46ff27ddf309a5a78c191fef9e4a811.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:3540