3a8f15131ff7af9e6d09484b0a5ab5cdcede337c7c446cdb6c14eba7cf10129c | Triage

Analysis

max time kernel
114s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
11-03-2022 01:18

Sharing

Report Analysis Logs

General

Target

3a8f15131ff7af9e6d09484b0a5ab5cdcede337c7c446cdb6c14eba7cf10129c.exe
Size

552KB
MD5

06153d592e4b95aa9aec75c012cbbb2c
SHA1

cb088bc89010e6c9b80bdc2e92307527ac2accca
SHA256

3a8f15131ff7af9e6d09484b0a5ab5cdcede337c7c446cdb6c14eba7cf10129c
SHA512

e719a626255ffaa1bca35be7400b51235dd7309b076aba8667cbd43ec39b6ecda83f3390793e9758b833a1ddb86f57858a8e20d7cd92124ae3c202492d265c91

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

3a8f15131ff7af9e6d09484b0a5ab5cdcede337c7c446cdb6c14eba7cf10129c.exefondue.exe

description	pid	process	target process
PID 3192 wrote to memory of 3736	3192	3a8f15131ff7af9e6d09484b0a5ab5cdcede337c7c446cdb6c14eba7cf10129c.exe	fondue.exe
PID 3192 wrote to memory of 3736	3192	3a8f15131ff7af9e6d09484b0a5ab5cdcede337c7c446cdb6c14eba7cf10129c.exe	fondue.exe
PID 3192 wrote to memory of 3736	3192	3a8f15131ff7af9e6d09484b0a5ab5cdcede337c7c446cdb6c14eba7cf10129c.exe	fondue.exe
PID 3736 wrote to memory of 2928	3736	fondue.exe	FonDUE.EXE
PID 3736 wrote to memory of 2928	3736	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\3a8f15131ff7af9e6d09484b0a5ab5cdcede337c7c446cdb6c14eba7cf10129c.exe
"C:\Users\Admin\AppData\Local\Temp\3a8f15131ff7af9e6d09484b0a5ab5cdcede337c7c446cdb6c14eba7cf10129c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3192

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3736

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:2928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads