b3e74c6905d76cc0049d6677166c49dff46ff27ddf309a5a78c191fef9e4a811 | Triage

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
11-03-2022 21:43

Sharing

Report Analysis Logs

General

Target

b3e74c6905d76cc0049d6677166c49dff46ff27ddf309a5a78c191fef9e4a811.exe
Size

552KB
MD5

c514aa2734caaed67ec3164823482df8
SHA1

b98c1b7ade50b3337eee9ab0425e5d9b07f7f3cd
SHA256

b3e74c6905d76cc0049d6677166c49dff46ff27ddf309a5a78c191fef9e4a811
SHA512

cbe028f578e5a7c6b51638f45f04444063acae039bb2b0e1046e03ad1f73118a96b548d6fdc1c3b8961f6f811427b0b77a9a66a531a2eed0ca23f9b8d7c0e6b5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

b3e74c6905d76cc0049d6677166c49dff46ff27ddf309a5a78c191fef9e4a811.exefondue.exe

description	pid	process	target process
PID 4084 wrote to memory of 408	4084	b3e74c6905d76cc0049d6677166c49dff46ff27ddf309a5a78c191fef9e4a811.exe	fondue.exe
PID 4084 wrote to memory of 408	4084	b3e74c6905d76cc0049d6677166c49dff46ff27ddf309a5a78c191fef9e4a811.exe	fondue.exe
PID 4084 wrote to memory of 408	4084	b3e74c6905d76cc0049d6677166c49dff46ff27ddf309a5a78c191fef9e4a811.exe	fondue.exe
PID 408 wrote to memory of 3540	408	fondue.exe	FonDUE.EXE
PID 408 wrote to memory of 3540	408	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\b3e74c6905d76cc0049d6677166c49dff46ff27ddf309a5a78c191fef9e4a811.exe
"C:\Users\Admin\AppData\Local\Temp\b3e74c6905d76cc0049d6677166c49dff46ff27ddf309a5a78c191fef9e4a811.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4084

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:408

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:3540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads