Analysis
-
max time kernel
125s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
22/02/2022, 21:13
Static task
static1
Behavioral task
behavioral1
Sample
0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe
Resource
win10v2004-en-20220112
0 signatures
0 seconds
General
-
Target
0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe
-
Size
520KB
-
MD5
a45274215d907b452dd15f533dcdc040
-
SHA1
706058351d4e554dc7587427925b0eecb8ee6e79
-
SHA256
0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a
-
SHA512
c95a34798767e0014b5f0d3482f51cde57c08af14fd531ee865a9be5f009fe2d782c129d7f1d3ca1409baaa628b408e7d6d488e434c05f4feca1270e3f68e66e
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 716 wrote to memory of 924 716 0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe 58 PID 716 wrote to memory of 924 716 0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe 58 PID 716 wrote to memory of 924 716 0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe 58 PID 924 wrote to memory of 116 924 fondue.exe 70 PID 924 wrote to memory of 116 924 fondue.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe"C:\Users\Admin\AppData\Local\Temp\0a82eb0c8e3d7c2334c4eff82dc394f65654bf72b8ceb6e9d940d90ed3a6ba0a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\fondue.exe"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll2⤵
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\system32\FonDUE.EXE"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll3⤵PID:116
-
-