0ec08ef4ed20233f9ea31687e2f8bb35ba3cdfbb8ccd0aeac1060ebcbe9873b7 | Triage

Analysis

max time kernel
124s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
22-02-2022 19:23

Sharing

Report Analysis Logs

General

Target

0ec08ef4ed20233f9ea31687e2f8bb35ba3cdfbb8ccd0aeac1060ebcbe9873b7.exe
Size

552KB
MD5

57fee168385ff171170b6582be68c824
SHA1

52993375265f5fc003618e8ef7e644b407a16342
SHA256

0ec08ef4ed20233f9ea31687e2f8bb35ba3cdfbb8ccd0aeac1060ebcbe9873b7
SHA512

311914d06ae105428bc386884c203dd6dd62f25493bdf6d38cc02b993c59d9b4546599d973e2bfa87cb7331d2e7fa24160db786b113df54d95767e3d1bb1d4be

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

0ec08ef4ed20233f9ea31687e2f8bb35ba3cdfbb8ccd0aeac1060ebcbe9873b7.exefondue.exe

description	pid	process	target process
PID 4416 wrote to memory of 4432	4416	0ec08ef4ed20233f9ea31687e2f8bb35ba3cdfbb8ccd0aeac1060ebcbe9873b7.exe	fondue.exe
PID 4416 wrote to memory of 4432	4416	0ec08ef4ed20233f9ea31687e2f8bb35ba3cdfbb8ccd0aeac1060ebcbe9873b7.exe	fondue.exe
PID 4416 wrote to memory of 4432	4416	0ec08ef4ed20233f9ea31687e2f8bb35ba3cdfbb8ccd0aeac1060ebcbe9873b7.exe	fondue.exe
PID 4432 wrote to memory of 3488	4432	fondue.exe	FonDUE.EXE
PID 4432 wrote to memory of 3488	4432	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\0ec08ef4ed20233f9ea31687e2f8bb35ba3cdfbb8ccd0aeac1060ebcbe9873b7.exe
"C:\Users\Admin\AppData\Local\Temp\0ec08ef4ed20233f9ea31687e2f8bb35ba3cdfbb8ccd0aeac1060ebcbe9873b7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4416

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4432

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:3488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads