470540d3bf0aa1d69b4acd2239621ef0090795be8dc290719145e15add2a2f47 | Triage

Analysis

max time kernel
134s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
10-03-2022 21:36

Sharing

Report Analysis Logs

General

Target

470540d3bf0aa1d69b4acd2239621ef0090795be8dc290719145e15add2a2f47.exe
Size

553KB
MD5

115fe1a6cf522d0778257e044570b04e
SHA1

278b91628ad2507dc3f9bd3c607b9c1423e85cb0
SHA256

470540d3bf0aa1d69b4acd2239621ef0090795be8dc290719145e15add2a2f47
SHA512

71e1bc50140d1170c6cbdcca651308f2d708d9f26b1ff84705d9adc01fbf836499d298764fa597cfa6212b918bc5953ed8a6d0f1aca97f8784393381c1685c4e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

470540d3bf0aa1d69b4acd2239621ef0090795be8dc290719145e15add2a2f47.exefondue.exe

description	pid	process	target process
PID 3268 wrote to memory of 4064	3268	470540d3bf0aa1d69b4acd2239621ef0090795be8dc290719145e15add2a2f47.exe	fondue.exe
PID 3268 wrote to memory of 4064	3268	470540d3bf0aa1d69b4acd2239621ef0090795be8dc290719145e15add2a2f47.exe	fondue.exe
PID 3268 wrote to memory of 4064	3268	470540d3bf0aa1d69b4acd2239621ef0090795be8dc290719145e15add2a2f47.exe	fondue.exe
PID 4064 wrote to memory of 4388	4064	fondue.exe	FonDUE.EXE
PID 4064 wrote to memory of 4388	4064	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\470540d3bf0aa1d69b4acd2239621ef0090795be8dc290719145e15add2a2f47.exe
"C:\Users\Admin\AppData\Local\Temp\470540d3bf0aa1d69b4acd2239621ef0090795be8dc290719145e15add2a2f47.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3268

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4064

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:4388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads