59ef5b795db30415b8b7cd21b186105e70a71f5e21bf1d2224ca5e6b58145e70 | Triage

Analysis

max time kernel
124s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
10-03-2022 15:38

Sharing

Report Analysis Logs

General

Target

59ef5b795db30415b8b7cd21b186105e70a71f5e21bf1d2224ca5e6b58145e70.exe
Size

552KB
MD5

42972a9a5ab46a5dcc9e72389c069db7
SHA1

53db1c679729bafccbcb35c64ca7f3e04aa7d9d8
SHA256

59ef5b795db30415b8b7cd21b186105e70a71f5e21bf1d2224ca5e6b58145e70
SHA512

26b1ccfe16ec9c25a878573896ee6afffdc150376b18857b3a45e03db67add767b065d6b03806c7692388100b23186d0ca2483f9514daad5a51c9dcce608d025

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

59ef5b795db30415b8b7cd21b186105e70a71f5e21bf1d2224ca5e6b58145e70.exefondue.exe

description	pid	process	target process
PID 4532 wrote to memory of 4228	4532	59ef5b795db30415b8b7cd21b186105e70a71f5e21bf1d2224ca5e6b58145e70.exe	fondue.exe
PID 4532 wrote to memory of 4228	4532	59ef5b795db30415b8b7cd21b186105e70a71f5e21bf1d2224ca5e6b58145e70.exe	fondue.exe
PID 4532 wrote to memory of 4228	4532	59ef5b795db30415b8b7cd21b186105e70a71f5e21bf1d2224ca5e6b58145e70.exe	fondue.exe
PID 4228 wrote to memory of 1664	4228	fondue.exe	FonDUE.EXE
PID 4228 wrote to memory of 1664	4228	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\59ef5b795db30415b8b7cd21b186105e70a71f5e21bf1d2224ca5e6b58145e70.exe
"C:\Users\Admin\AppData\Local\Temp\59ef5b795db30415b8b7cd21b186105e70a71f5e21bf1d2224ca5e6b58145e70.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4532

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4228

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads