8dd1b5caf0cd6f4d0972591216d4898f1a9dd4dbae2a2b5c92cc568d561cd144

Analysis

Target
PAYMENT SLIP.exe
Size 1.0MB
Sample220412-mw82ysagbl
SHA256 8dd1b5caf0cd6f4d0972591216d4898f1a9dd4dbae2a2b5c92cc568d561cd144
MD5 765a397dd23048189ba17c85d4d57535
SHA1 724ab5d57541aa87b97ff24270c63abf49ed170f
SHA512 a6fb1cb1acf882eedc124244cf3498d3c4567a81f3a49d1f0ce7f078015b76404af1473d1b0b65a6b26ab8773b731c2eabc6652a4c740d12a447d6802aa9a7a5
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 4760	2160	PAYMENT SLIP.exe	81
PID 2160 wrote to memory of 4760	2160	PAYMENT SLIP.exe	81
PID 2160 wrote to memory of 4760	2160	PAYMENT SLIP.exe	81
PID 4760 wrote to memory of 4360	4760	fondue.exe	82
PID 4760 wrote to memory of 4360	4760	fondue.exe	82

C:\Users\Admin\AppData\Local\Temp\PAYMENT SLIP.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENT SLIP.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:4360