3b2bc76df7efa683c4566cc2d86b7b3e094b953eccb6aee14229185c7ee58d0c | Triage

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
11-03-2022 01:06

Sharing

Report Analysis Logs

General

Target

3b2bc76df7efa683c4566cc2d86b7b3e094b953eccb6aee14229185c7ee58d0c.exe
Size

552KB
MD5

c22961455558772a3eb94b470560b9d5
SHA1

9ab4977126485322978f549a30a6c76e9ea2596b
SHA256

3b2bc76df7efa683c4566cc2d86b7b3e094b953eccb6aee14229185c7ee58d0c
SHA512

d0426a2f5bb4ca1461fab19a5b003e27e955b1f9824824cd581d1671ed525147bc262e45812aba827d5955c50b9c631e97bd88ecf669866dc34a529c9c9918e2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

3b2bc76df7efa683c4566cc2d86b7b3e094b953eccb6aee14229185c7ee58d0c.exefondue.exe

description	pid	process	target process
PID 3728 wrote to memory of 3628	3728	3b2bc76df7efa683c4566cc2d86b7b3e094b953eccb6aee14229185c7ee58d0c.exe	fondue.exe
PID 3728 wrote to memory of 3628	3728	3b2bc76df7efa683c4566cc2d86b7b3e094b953eccb6aee14229185c7ee58d0c.exe	fondue.exe
PID 3728 wrote to memory of 3628	3728	3b2bc76df7efa683c4566cc2d86b7b3e094b953eccb6aee14229185c7ee58d0c.exe	fondue.exe
PID 3628 wrote to memory of 3704	3628	fondue.exe	FonDUE.EXE
PID 3628 wrote to memory of 3704	3628	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\3b2bc76df7efa683c4566cc2d86b7b3e094b953eccb6aee14229185c7ee58d0c.exe
"C:\Users\Admin\AppData\Local\Temp\3b2bc76df7efa683c4566cc2d86b7b3e094b953eccb6aee14229185c7ee58d0c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3728

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3628

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:3704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads