6c47e2e3c113778424298e744a5ffd42da81c783c0a0336e837ca49d8a513fe3 | Triage

Analysis

max time kernel
134s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
10-03-2022 02:49

Sharing

Report Analysis Logs

General

Target

6c47e2e3c113778424298e744a5ffd42da81c783c0a0336e837ca49d8a513fe3.exe
Size

552KB
MD5

0c2382bdc6a7bfd0070d63bf2abb1485
SHA1

b47ee34d4df7270c7849dc9d1f2031c8afce19e1
SHA256

6c47e2e3c113778424298e744a5ffd42da81c783c0a0336e837ca49d8a513fe3
SHA512

a59e428fbd2913e3abb1827f42484a73b0e85de9f0a020fb794cc4d2c2ac10db59dc0b4469bb8c77bdbf8f3b4a8ccbb8378c8d10635e02abc81a45924531f55f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

6c47e2e3c113778424298e744a5ffd42da81c783c0a0336e837ca49d8a513fe3.exefondue.exe

description	pid	process	target process
PID 1596 wrote to memory of 1968	1596	6c47e2e3c113778424298e744a5ffd42da81c783c0a0336e837ca49d8a513fe3.exe	fondue.exe
PID 1596 wrote to memory of 1968	1596	6c47e2e3c113778424298e744a5ffd42da81c783c0a0336e837ca49d8a513fe3.exe	fondue.exe
PID 1596 wrote to memory of 1968	1596	6c47e2e3c113778424298e744a5ffd42da81c783c0a0336e837ca49d8a513fe3.exe	fondue.exe
PID 1968 wrote to memory of 2572	1968	fondue.exe	FonDUE.EXE
PID 1968 wrote to memory of 2572	1968	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\6c47e2e3c113778424298e744a5ffd42da81c783c0a0336e837ca49d8a513fe3.exe
"C:\Users\Admin\AppData\Local\Temp\6c47e2e3c113778424298e744a5ffd42da81c783c0a0336e837ca49d8a513fe3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:2572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads