ad81f26f5ca72f78d7cf54ee44c6c74dd7e3584a040bc40c4b3a613f113af02e | Triage

Analysis

max time kernel
138s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
11-03-2022 23:39

Sharing

Report Analysis Logs

General

Target

ad81f26f5ca72f78d7cf54ee44c6c74dd7e3584a040bc40c4b3a613f113af02e.exe
Size

552KB
MD5

52d2d155adf27c31e409fed66f7ae663
SHA1

f28c3e5ad2cbaa0e524282f476f9c49465d516c9
SHA256

ad81f26f5ca72f78d7cf54ee44c6c74dd7e3584a040bc40c4b3a613f113af02e
SHA512

a310dd7b2a892c10df76f848925ebac989b6311fa7b2ba58730b456a582a3e7a0947641d7beb75c376202ca996981a55836d4e8a56a322d2a2b3e19f6823c629

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

ad81f26f5ca72f78d7cf54ee44c6c74dd7e3584a040bc40c4b3a613f113af02e.exefondue.exe

description	pid	process	target process
PID 4456 wrote to memory of 4288	4456	ad81f26f5ca72f78d7cf54ee44c6c74dd7e3584a040bc40c4b3a613f113af02e.exe	fondue.exe
PID 4456 wrote to memory of 4288	4456	ad81f26f5ca72f78d7cf54ee44c6c74dd7e3584a040bc40c4b3a613f113af02e.exe	fondue.exe
PID 4456 wrote to memory of 4288	4456	ad81f26f5ca72f78d7cf54ee44c6c74dd7e3584a040bc40c4b3a613f113af02e.exe	fondue.exe
PID 4288 wrote to memory of 3532	4288	fondue.exe	FonDUE.EXE
PID 4288 wrote to memory of 3532	4288	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\ad81f26f5ca72f78d7cf54ee44c6c74dd7e3584a040bc40c4b3a613f113af02e.exe
"C:\Users\Admin\AppData\Local\Temp\ad81f26f5ca72f78d7cf54ee44c6c74dd7e3584a040bc40c4b3a613f113af02e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4456

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4288

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:3532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads