acdc72868926b4d62fb758d3d1eeee1eb32da214d8f49bc725083d36c095507c | Triage

Analysis

max time kernel
154s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
11-03-2022 23:53

Sharing

Report Analysis Logs

General

Target

acdc72868926b4d62fb758d3d1eeee1eb32da214d8f49bc725083d36c095507c.exe
Size

552KB
MD5

0a612f99a4d38c7ce39cb9eacc5c584d
SHA1

49da7923cb0bd2ee4b90a80be77a9948ca37fd03
SHA256

acdc72868926b4d62fb758d3d1eeee1eb32da214d8f49bc725083d36c095507c
SHA512

d49b1069ac5b3caeda2517ec82b11e026ca7f820b47a9c48836980f7a10421b5cdaaa43d0446454ae7cc62a65da4718a335a4cca24e394f386f5dab70e35a5eb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

acdc72868926b4d62fb758d3d1eeee1eb32da214d8f49bc725083d36c095507c.exefondue.exe

description	pid	process	target process
PID 4844 wrote to memory of 1696	4844	acdc72868926b4d62fb758d3d1eeee1eb32da214d8f49bc725083d36c095507c.exe	fondue.exe
PID 4844 wrote to memory of 1696	4844	acdc72868926b4d62fb758d3d1eeee1eb32da214d8f49bc725083d36c095507c.exe	fondue.exe
PID 4844 wrote to memory of 1696	4844	acdc72868926b4d62fb758d3d1eeee1eb32da214d8f49bc725083d36c095507c.exe	fondue.exe
PID 1696 wrote to memory of 3068	1696	fondue.exe	FonDUE.EXE
PID 1696 wrote to memory of 3068	1696	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\acdc72868926b4d62fb758d3d1eeee1eb32da214d8f49bc725083d36c095507c.exe
"C:\Users\Admin\AppData\Local\Temp\acdc72868926b4d62fb758d3d1eeee1eb32da214d8f49bc725083d36c095507c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4844

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads