37d8e1ce3b6e6488942717aa78cb54785edc985143bcc8d9ba9f42d73a3dbd7a | Triage

Analysis

max time kernel
614s
max time network
1602s
platform
windows10_x64
resource
win10-20220223-en
submitted
08-03-2022 10:35

Sharing

Report Analysis Logs

General

Target

RIP_YOUR_PC_LOL.exe
Size

22.5MB
MD5

52867174362410d63215d78e708103ea
SHA1

7ae4e1048e4463a4201bdeaf224c5b6face681bf
SHA256

37d8e1ce3b6e6488942717aa78cb54785edc985143bcc8d9ba9f42d73a3dbd7a
SHA512

89e17e147d3f073e479e85d0b0321f6264bbc2aa84c930ed645e8f5cde3f1e58812c3db1ba0f10bee6ce7ac0731e1e3de6747a9b3c4d63a564dd8d904bd726ab

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

RIP_YOUR_PC_LOL.exefondue.exe

description	pid	process	target process
PID 3532 wrote to memory of 3456	3532	RIP_YOUR_PC_LOL.exe	fondue.exe
PID 3532 wrote to memory of 3456	3532	RIP_YOUR_PC_LOL.exe	fondue.exe
PID 3532 wrote to memory of 3456	3532	RIP_YOUR_PC_LOL.exe	fondue.exe
PID 3456 wrote to memory of 3428	3456	fondue.exe	FonDUE.EXE
PID 3456 wrote to memory of 3428	3456	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\RIP_YOUR_PC_LOL.exe
"C:\Users\Admin\AppData\Local\Temp\RIP_YOUR_PC_LOL.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3532

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3456

C:\Windows\System32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:3428

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...