37d8e1ce3b6e6488942717aa78cb54785edc985143bcc8d9ba9f42d73a3dbd7a | Triage

Resubmissions

15-03-2022 08:40

220315-klcjwshbh7 10

11-03-2022 16:17

220311-trnzjsdcar 10

11-03-2022 15:27

220311-sv8yfsdbam 10

09-03-2022 15:19

220309-sp9ykacfan 10

Analysis

max time kernel
305s
max time network
251s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
11-03-2022 15:27

Sharing

Report Analysis Logs

General

Target

RIP_YOUR_PC_LOL.exe
Size

22.5MB
MD5

52867174362410d63215d78e708103ea
SHA1

7ae4e1048e4463a4201bdeaf224c5b6face681bf
SHA256

37d8e1ce3b6e6488942717aa78cb54785edc985143bcc8d9ba9f42d73a3dbd7a
SHA512

89e17e147d3f073e479e85d0b0321f6264bbc2aa84c930ed645e8f5cde3f1e58812c3db1ba0f10bee6ce7ac0731e1e3de6747a9b3c4d63a564dd8d904bd726ab

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

RIP_YOUR_PC_LOL.exefondue.exe

description	pid	process	target process
PID 1936 wrote to memory of 2064	1936	RIP_YOUR_PC_LOL.exe	fondue.exe
PID 1936 wrote to memory of 2064	1936	RIP_YOUR_PC_LOL.exe	fondue.exe
PID 1936 wrote to memory of 2064	1936	RIP_YOUR_PC_LOL.exe	fondue.exe
PID 2064 wrote to memory of 2512	2064	fondue.exe	FonDUE.EXE
PID 2064 wrote to memory of 2512	2064	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\RIP_YOUR_PC_LOL.exe
"C:\Users\Admin\AppData\Local\Temp\RIP_YOUR_PC_LOL.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2064

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:2512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...