043c169d0584b09a3b079fe7f34d61caf807b8ec8e0ab52c152d16f29fb2458c | Triage

Analysis

max time kernel
176s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
23-02-2022 00:01

Sharing

Report Analysis Logs

General

Target

043c169d0584b09a3b079fe7f34d61caf807b8ec8e0ab52c152d16f29fb2458c.exe
Size

552KB
MD5

541e971bd55a3659da4da1728d6b646b
SHA1

b96bc48d66a6bad429d08c8d9ea10e4e6cd664c1
SHA256

043c169d0584b09a3b079fe7f34d61caf807b8ec8e0ab52c152d16f29fb2458c
SHA512

ade11924caca16c9b8427a165a76a77b2be97ec4c708008a91270bbfb0c9dea59c0e98adcecf4b3657c5b4a3ef6e6a4922d13e7c406d9d5df4791c3b7eeb4974

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

043c169d0584b09a3b079fe7f34d61caf807b8ec8e0ab52c152d16f29fb2458c.exefondue.exe

description	pid	process	target process
PID 2068 wrote to memory of 3420	2068	043c169d0584b09a3b079fe7f34d61caf807b8ec8e0ab52c152d16f29fb2458c.exe	fondue.exe
PID 2068 wrote to memory of 3420	2068	043c169d0584b09a3b079fe7f34d61caf807b8ec8e0ab52c152d16f29fb2458c.exe	fondue.exe
PID 2068 wrote to memory of 3420	2068	043c169d0584b09a3b079fe7f34d61caf807b8ec8e0ab52c152d16f29fb2458c.exe	fondue.exe
PID 3420 wrote to memory of 2492	3420	fondue.exe	FonDUE.EXE
PID 3420 wrote to memory of 2492	3420	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\043c169d0584b09a3b079fe7f34d61caf807b8ec8e0ab52c152d16f29fb2458c.exe
"C:\Users\Admin\AppData\Local\Temp\043c169d0584b09a3b079fe7f34d61caf807b8ec8e0ab52c152d16f29fb2458c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2068

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3420

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:2492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads