52ec1d54b1442de234083a4c03d26e2a5465179bfb368e5662b47f417efce904 | Triage

Analysis

max time kernel
129s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
11-03-2022 10:38

Sharing

Report Analysis Logs

General

Target

aee47c9f2a800ba2748a52c7fbe988a5.exe
Size

37KB
MD5

aee47c9f2a800ba2748a52c7fbe988a5
SHA1

ade132a9ed46804cc1878676706985429b2dbab3
SHA256

52ec1d54b1442de234083a4c03d26e2a5465179bfb368e5662b47f417efce904
SHA512

429a738b3d209987f5c9390e7a25927c1d629844046055fe250609dd59272bc29442101351e4f47ef89182f44ef6fcf2dc38b4e294828f17f6adafe6cdf200c3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

aee47c9f2a800ba2748a52c7fbe988a5.exefondue.exe

description	pid	process	target process
PID 3048 wrote to memory of 3900	3048	aee47c9f2a800ba2748a52c7fbe988a5.exe	fondue.exe
PID 3048 wrote to memory of 3900	3048	aee47c9f2a800ba2748a52c7fbe988a5.exe	fondue.exe
PID 3048 wrote to memory of 3900	3048	aee47c9f2a800ba2748a52c7fbe988a5.exe	fondue.exe
PID 3900 wrote to memory of 4268	3900	fondue.exe	FonDUE.EXE
PID 3900 wrote to memory of 4268	3900	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\aee47c9f2a800ba2748a52c7fbe988a5.exe
"C:\Users\Admin\AppData\Local\Temp\aee47c9f2a800ba2748a52c7fbe988a5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3900

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:4268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...