3b2bc76df7efa683c4566cc2d86b7b3e094b953eccb6aee14229185c7ee58d0c

Analysis

Target
3b2bc76df7efa683c4566cc2d86b7b3e094b953eccb6aee14229185c7ee58d0c.exe
Size 552KB
Sample220311-bgcveseaf3
SHA256 3b2bc76df7efa683c4566cc2d86b7b3e094b953eccb6aee14229185c7ee58d0c
MD5 c22961455558772a3eb94b470560b9d5
SHA1 9ab4977126485322978f549a30a6c76e9ea2596b
SHA512 d0426a2f5bb4ca1461fab19a5b003e27e955b1f9824824cd581d1671ed525147bc262e45812aba827d5955c50b9c631e97bd88ecf669866dc34a529c9c9918e2
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 3628	3728	3b2bc76df7efa683c4566cc2d86b7b3e094b953eccb6aee14229185c7ee58d0c.exe	79
PID 3728 wrote to memory of 3628	3728	3b2bc76df7efa683c4566cc2d86b7b3e094b953eccb6aee14229185c7ee58d0c.exe	79
PID 3728 wrote to memory of 3628	3728	3b2bc76df7efa683c4566cc2d86b7b3e094b953eccb6aee14229185c7ee58d0c.exe	79
PID 3628 wrote to memory of 3704	3628	fondue.exe	80
PID 3628 wrote to memory of 3704	3628	fondue.exe	80

C:\Users\Admin\AppData\Local\Temp\3b2bc76df7efa683c4566cc2d86b7b3e094b953eccb6aee14229185c7ee58d0c.exe
"C:\Users\Admin\AppData\Local\Temp\3b2bc76df7efa683c4566cc2d86b7b3e094b953eccb6aee14229185c7ee58d0c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:3704