a100ce0a67c5890bcc38d2b6e30f9164dfe266126ec40a2fd7eb8e941dc7d025 | Triage

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
12-03-2022 03:31

Sharing

Report Analysis Logs

General

Target

a100ce0a67c5890bcc38d2b6e30f9164dfe266126ec40a2fd7eb8e941dc7d025.exe
Size

552KB
MD5

713e8df6bd82d3260543d0d969905d5b
SHA1

e0fb35f6f3672d51140dc240ae23e627a4043a0f
SHA256

a100ce0a67c5890bcc38d2b6e30f9164dfe266126ec40a2fd7eb8e941dc7d025
SHA512

47e75a0604ec838992b9e9a552c7727c6902a8b0627b9f254f2ca9ae1fa70f5762895e94e32b40b3a2a1dfe0246043dd4ad4cb983a0bac7546275189c5375953

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

a100ce0a67c5890bcc38d2b6e30f9164dfe266126ec40a2fd7eb8e941dc7d025.exefondue.exe

description	pid	process	target process
PID 3040 wrote to memory of 3068	3040	a100ce0a67c5890bcc38d2b6e30f9164dfe266126ec40a2fd7eb8e941dc7d025.exe	fondue.exe
PID 3040 wrote to memory of 3068	3040	a100ce0a67c5890bcc38d2b6e30f9164dfe266126ec40a2fd7eb8e941dc7d025.exe	fondue.exe
PID 3040 wrote to memory of 3068	3040	a100ce0a67c5890bcc38d2b6e30f9164dfe266126ec40a2fd7eb8e941dc7d025.exe	fondue.exe
PID 3068 wrote to memory of 4488	3068	fondue.exe	FonDUE.EXE
PID 3068 wrote to memory of 4488	3068	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\a100ce0a67c5890bcc38d2b6e30f9164dfe266126ec40a2fd7eb8e941dc7d025.exe
"C:\Users\Admin\AppData\Local\Temp\a100ce0a67c5890bcc38d2b6e30f9164dfe266126ec40a2fd7eb8e941dc7d025.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:4488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads