98a835c2be0b56df2a4a165bb9f437f18edd844e90e0e3a9ef5a6140476ccd9c

Analysis

Target
SecuriteInfo.com.Trojan.MulDrop6.57674.13164.exe
Size 1.2MB
Sample220414-ml4pgsbab7
SHA256 98a835c2be0b56df2a4a165bb9f437f18edd844e90e0e3a9ef5a6140476ccd9c
MD5 fa8354e9715ed8e745403b6f8f163f50
SHA1 b2f9a493a5390006aae5a5c93da49c9b7ef27b3f
SHA512 8ecebd1f3fcd40458759127c0c0d10d0010968c2f86975959839c05b4725f5c10b4d111cff654e6f489f3eab11a8ac3f188ffdda964bcf91bd35e42f4da9d6b0
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4608	4644	SecuriteInfo.com.Trojan.MulDrop6.57674.13164.exe	82
PID 4644 wrote to memory of 4608	4644	SecuriteInfo.com.Trojan.MulDrop6.57674.13164.exe	82
PID 4644 wrote to memory of 4608	4644	SecuriteInfo.com.Trojan.MulDrop6.57674.13164.exe	82
PID 4608 wrote to memory of 3216	4608	fondue.exe	83
PID 4608 wrote to memory of 3216	4608	fondue.exe	83

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop6.57674.13164.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop6.57674.13164.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:3216