14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9 | Triage

Resubmissions

09-10-2023 22:49

231009-2rwndsgh8w 10

06-03-2022 02:50

220306-dbkzyshha4 10

Analysis

max time kernel
90s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
06-03-2022 02:50

Sharing

Report Analysis Logs

General

Target

14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9.exe
Size

136KB
MD5

17f29268c9f1c5d5bca8b2b66cd1044c
SHA1

16273c67d772dccd1bc9d375b1c9ffa25e83129c
SHA256

14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9
SHA512

bd4d3f760de8225626f748f0168188d40c283b1a5525234cb8ff63621ff5f5952c6d6bf6de464485784641ff7aa08d89979ad000d26feb34f44fc231287ab1db

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9.exe

description	pid	process	target process
PID 220 wrote to memory of 3876	220	14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9.exe	fondue.exe
PID 220 wrote to memory of 3876	220	14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9.exe	fondue.exe

C:\Users\Admin\AppData\Local\Temp\14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9.exe
"C:\Users\Admin\AppData\Local\Temp\14ee5fe40e76955ea27cc715dd5849f10ce7dc992c234db67467bbb1757aa8f9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:220

C:\Windows\system32\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
PID:3876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...