f6b2c58f9846adcb295edd3c8a5beaec31fff3bc98f6503d04e95be3f9f072e8

Analysis

Target

f6b2c58f9846adcb295edd3c8a5beaec31fff3bc98f6503d04e95be3f9f072e8.exe
Size

24KB
MD5

c25b797d6737751936766cd50e26d725
SHA1

dfb3bfb53ce0430c8af1ee7b145408d63b1bec67
SHA256

f6b2c58f9846adcb295edd3c8a5beaec31fff3bc98f6503d04e95be3f9f072e8
SHA512

28871ab7d533a22d78545dd740df0c8b93ab0e9e0d81901faaf30d4656c953162ee1e049dcfbba0050405e7441eee77f056445653a8bd927963b8f81d9bf8eed

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

f6b2c58f9846adcb295edd3c8a5beaec31fff3bc98f6503d04e95be3f9f072e8.exefondue.exe

description	pid	process	target process
PID 3096 wrote to memory of 3468	3096	f6b2c58f9846adcb295edd3c8a5beaec31fff3bc98f6503d04e95be3f9f072e8.exe	fondue.exe
PID 3096 wrote to memory of 3468	3096	f6b2c58f9846adcb295edd3c8a5beaec31fff3bc98f6503d04e95be3f9f072e8.exe	fondue.exe
PID 3096 wrote to memory of 3468	3096	f6b2c58f9846adcb295edd3c8a5beaec31fff3bc98f6503d04e95be3f9f072e8.exe	fondue.exe
PID 3468 wrote to memory of 4124	3468	fondue.exe	FonDUE.EXE
PID 3468 wrote to memory of 4124	3468	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\f6b2c58f9846adcb295edd3c8a5beaec31fff3bc98f6503d04e95be3f9f072e8.exe
"C:\Users\Admin\AppData\Local\Temp\f6b2c58f9846adcb295edd3c8a5beaec31fff3bc98f6503d04e95be3f9f072e8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:4124