2ec90df668caec1d94c3d787e8fd915567888788938e14ca0a86dcda9c8124eb

Analysis

Target
a58c94f7cedbf12a9de75d4565c45387.exe
Size 31KB
Sample220323-bkl79sdbf3
SHA256 2ec90df668caec1d94c3d787e8fd915567888788938e14ca0a86dcda9c8124eb
MD5 a58c94f7cedbf12a9de75d4565c45387
SHA1 d1c5d8cb00e8ab6f41429efcea4c26c10e2a32fb
SHA512 63a6cb30679bc8a6e4de972f74413692a21c7c39abddb036e57f75ed42dbae7ba06890221fed7dcc1df9c89c4061775f52b3fef57f31c08f59efbad0a6b12d9e
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 3600	3736	a58c94f7cedbf12a9de75d4565c45387.exe	79
PID 3736 wrote to memory of 3600	3736	a58c94f7cedbf12a9de75d4565c45387.exe	79
PID 3736 wrote to memory of 3600	3736	a58c94f7cedbf12a9de75d4565c45387.exe	79
PID 3600 wrote to memory of 3548	3600	fondue.exe	80
PID 3600 wrote to memory of 3548	3600	fondue.exe	80

C:\Users\Admin\AppData\Local\Temp\a58c94f7cedbf12a9de75d4565c45387.exe
"C:\Users\Admin\AppData\Local\Temp\a58c94f7cedbf12a9de75d4565c45387.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:3548

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
1⤵
PID:2396