113d72ee9b8799d507cde23c44fa2b97e31dbbb141f2c8d6b0bdd157da628c66

Analysis

Target

113d72ee9b8799d507cde23c44fa2b97e31dbbb141f2c8d6b0bdd157da628c66.exe
Size

1.2MB
MD5

9b2734137accced6a1c34e28ffe9e907
SHA1

11de47bc139e4232eb6933075a457e2782fbecd8
SHA256

113d72ee9b8799d507cde23c44fa2b97e31dbbb141f2c8d6b0bdd157da628c66
SHA512

eb52ceb42180215d85c2ddaf72a60ab1346c267b0ef9ca25fbc1ad15d766f6097cec432a84f06555b7dfc11a7c6dcec3aac75cad5d15e117c8e37eeda6215e9d

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 3352	4520	113d72ee9b8799d507cde23c44fa2b97e31dbbb141f2c8d6b0bdd157da628c66.exe	24
PID 4520 wrote to memory of 3352	4520	113d72ee9b8799d507cde23c44fa2b97e31dbbb141f2c8d6b0bdd157da628c66.exe	24
PID 4520 wrote to memory of 3352	4520	113d72ee9b8799d507cde23c44fa2b97e31dbbb141f2c8d6b0bdd157da628c66.exe	24
PID 3352 wrote to memory of 1128	3352	fondue.exe	76
PID 3352 wrote to memory of 1128	3352	fondue.exe	76

C:\Users\Admin\AppData\Local\Temp\113d72ee9b8799d507cde23c44fa2b97e31dbbb141f2c8d6b0bdd157da628c66.exe
"C:\Users\Admin\AppData\Local\Temp\113d72ee9b8799d507cde23c44fa2b97e31dbbb141f2c8d6b0bdd157da628c66.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:1128