5b092b9eae4e57fab721a1e5b5a7cb92afe81fd1cc24d371cfa44c9cb0bb88fa

Analysis

Target
5b092b9eae4e57fab721a1e5b5a7cb92afe81fd1cc24d371cfa44c9cb0bb88fa.exe
Size 593KB
Sample220319-n3emcshce2
SHA256 5b092b9eae4e57fab721a1e5b5a7cb92afe81fd1cc24d371cfa44c9cb0bb88fa
MD5 c43fe8c5ca00ddf821a56b2b6ccc8584
SHA1 dc0424cf138ae4cd0d6c52d684fb1df3bd5af6f1
SHA512 e29ebd1b452c1dae15ebb7b30f8955be74dec4d07c5a0f48dcf190f638a9bba79ca8fc02c9ad413c10af6081621576d3ebd1b4ffda2c9afb1b61a00cc064af86
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 3680	3164	5b092b9eae4e57fab721a1e5b5a7cb92afe81fd1cc24d371cfa44c9cb0bb88fa.exe	80
PID 3164 wrote to memory of 3680	3164	5b092b9eae4e57fab721a1e5b5a7cb92afe81fd1cc24d371cfa44c9cb0bb88fa.exe	80
PID 3164 wrote to memory of 3680	3164	5b092b9eae4e57fab721a1e5b5a7cb92afe81fd1cc24d371cfa44c9cb0bb88fa.exe	80
PID 3680 wrote to memory of 8	3680	fondue.exe	81
PID 3680 wrote to memory of 8	3680	fondue.exe	81

C:\Users\Admin\AppData\Local\Temp\5b092b9eae4e57fab721a1e5b5a7cb92afe81fd1cc24d371cfa44c9cb0bb88fa.exe
"C:\Users\Admin\AppData\Local\Temp\5b092b9eae4e57fab721a1e5b5a7cb92afe81fd1cc24d371cfa44c9cb0bb88fa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:8