58413be3d0f3fecc47a190dc12bcd9269b878e1d5d707c55afb4127179895a6a | Triage

Analysis

max time kernel
109s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
10-03-2022 16:40

Sharing

Report Analysis Logs

General

Target

58413be3d0f3fecc47a190dc12bcd9269b878e1d5d707c55afb4127179895a6a.exe
Size

552KB
MD5

0afc9295c73529b7acc0ba3c6690a2e3
SHA1

5349d645e23d0a000bb974a3b1a598650e3198a5
SHA256

58413be3d0f3fecc47a190dc12bcd9269b878e1d5d707c55afb4127179895a6a
SHA512

7a0bcc6b044b810bf92159260f104e6be8c88085e36d74e6cdb8e6cf94d8d62a91c7bf5414689c70f93671700b138f5ed77a46345113106bec6303b85c9b2c00

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

58413be3d0f3fecc47a190dc12bcd9269b878e1d5d707c55afb4127179895a6a.exefondue.exe

description	pid	process	target process
PID 2456 wrote to memory of 3496	2456	58413be3d0f3fecc47a190dc12bcd9269b878e1d5d707c55afb4127179895a6a.exe	fondue.exe
PID 2456 wrote to memory of 3496	2456	58413be3d0f3fecc47a190dc12bcd9269b878e1d5d707c55afb4127179895a6a.exe	fondue.exe
PID 2456 wrote to memory of 3496	2456	58413be3d0f3fecc47a190dc12bcd9269b878e1d5d707c55afb4127179895a6a.exe	fondue.exe
PID 3496 wrote to memory of 3308	3496	fondue.exe	FonDUE.EXE
PID 3496 wrote to memory of 3308	3496	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\58413be3d0f3fecc47a190dc12bcd9269b878e1d5d707c55afb4127179895a6a.exe
"C:\Users\Admin\AppData\Local\Temp\58413be3d0f3fecc47a190dc12bcd9269b878e1d5d707c55afb4127179895a6a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3496

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:3308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads