ac53fd35f87c5206f66423e0fb6357034e2ec404032ce0e9b8b2a024f6f9d0f9 | Triage

Analysis

max time kernel
138s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
12-03-2022 00:04

Sharing

Report Analysis Logs

General

Target

ac53fd35f87c5206f66423e0fb6357034e2ec404032ce0e9b8b2a024f6f9d0f9.exe
Size

552KB
MD5

c6a959d93a7b8b19400c9384bdad3055
SHA1

af8ad58deb3940007f29c17e3b5d923d4ca0043e
SHA256

ac53fd35f87c5206f66423e0fb6357034e2ec404032ce0e9b8b2a024f6f9d0f9
SHA512

97a935aff1b62cabab524c6dcc3862cad5d6486979324b1c28eec0023125a1d34e8c3d35727b703fd8eea2dfee82ffb2a05e85ab96e649312aa2bcbfbb8e728e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

ac53fd35f87c5206f66423e0fb6357034e2ec404032ce0e9b8b2a024f6f9d0f9.exefondue.exe

description	pid	process	target process
PID 1928 wrote to memory of 1804	1928	ac53fd35f87c5206f66423e0fb6357034e2ec404032ce0e9b8b2a024f6f9d0f9.exe	fondue.exe
PID 1928 wrote to memory of 1804	1928	ac53fd35f87c5206f66423e0fb6357034e2ec404032ce0e9b8b2a024f6f9d0f9.exe	fondue.exe
PID 1928 wrote to memory of 1804	1928	ac53fd35f87c5206f66423e0fb6357034e2ec404032ce0e9b8b2a024f6f9d0f9.exe	fondue.exe
PID 1804 wrote to memory of 2436	1804	fondue.exe	FonDUE.EXE
PID 1804 wrote to memory of 2436	1804	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\ac53fd35f87c5206f66423e0fb6357034e2ec404032ce0e9b8b2a024f6f9d0f9.exe
"C:\Users\Admin\AppData\Local\Temp\ac53fd35f87c5206f66423e0fb6357034e2ec404032ce0e9b8b2a024f6f9d0f9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:2436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads