f891bd59c1f20b763e196ab43a8579cb39e4aa9122f5dcf3cff0b4ef72b880e0

Analysis

Target

f891bd59c1f20b763e196ab43a8579cb39e4aa9122f5dcf3cff0b4ef72b880e0.exe
Size

552KB
MD5

6ecbb3a6667cfa539b220a0e48067c5d
SHA1

3bd94922e5d70fdbf117a403a95047c471895e07
SHA256

f891bd59c1f20b763e196ab43a8579cb39e4aa9122f5dcf3cff0b4ef72b880e0
SHA512

eb727cba1ba6d34e28c6e050d18200bf4abff8b84cad2523238a3b04a9b6219b658567bf4850ea3f7cb01e2d11defd7306576110a3ff77665c5e61d22eb126f0

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4884	3404	f891bd59c1f20b763e196ab43a8579cb39e4aa9122f5dcf3cff0b4ef72b880e0.exe	80
PID 3404 wrote to memory of 4884	3404	f891bd59c1f20b763e196ab43a8579cb39e4aa9122f5dcf3cff0b4ef72b880e0.exe	80
PID 3404 wrote to memory of 4884	3404	f891bd59c1f20b763e196ab43a8579cb39e4aa9122f5dcf3cff0b4ef72b880e0.exe	80
PID 4884 wrote to memory of 4200	4884	fondue.exe	81
PID 4884 wrote to memory of 4200	4884	fondue.exe	81

C:\Users\Admin\AppData\Local\Temp\f891bd59c1f20b763e196ab43a8579cb39e4aa9122f5dcf3cff0b4ef72b880e0.exe
"C:\Users\Admin\AppData\Local\Temp\f891bd59c1f20b763e196ab43a8579cb39e4aa9122f5dcf3cff0b4ef72b880e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:4200