a0f4a5d94ba4ada8aa8707f663e4dec69c095f945f662d269e7f5b5795cd160b | Triage

Analysis

max time kernel
121s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
12-03-2022 03:32

Sharing

Report Analysis Logs

General

Target

a0f4a5d94ba4ada8aa8707f663e4dec69c095f945f662d269e7f5b5795cd160b.exe
Size

552KB
MD5

2358efde4743bce80de99414e15b5f80
SHA1

c97d7b29cfbc18624638f7524850298e3ddfc20a
SHA256

a0f4a5d94ba4ada8aa8707f663e4dec69c095f945f662d269e7f5b5795cd160b
SHA512

94499bf58e1ad3177860359e5dc909a0c1f43fbb38cdf979d333f1010fa5c5fa3a4691d0ac7f6b98d9fd78a24b3f5ada5d6358703bd5816beb5dd10ca4e41c86

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

a0f4a5d94ba4ada8aa8707f663e4dec69c095f945f662d269e7f5b5795cd160b.exefondue.exe

description	pid	process	target process
PID 1516 wrote to memory of 1712	1516	a0f4a5d94ba4ada8aa8707f663e4dec69c095f945f662d269e7f5b5795cd160b.exe	fondue.exe
PID 1516 wrote to memory of 1712	1516	a0f4a5d94ba4ada8aa8707f663e4dec69c095f945f662d269e7f5b5795cd160b.exe	fondue.exe
PID 1516 wrote to memory of 1712	1516	a0f4a5d94ba4ada8aa8707f663e4dec69c095f945f662d269e7f5b5795cd160b.exe	fondue.exe
PID 1712 wrote to memory of 2268	1712	fondue.exe	FonDUE.EXE
PID 1712 wrote to memory of 2268	1712	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\a0f4a5d94ba4ada8aa8707f663e4dec69c095f945f662d269e7f5b5795cd160b.exe
"C:\Users\Admin\AppData\Local\Temp\a0f4a5d94ba4ada8aa8707f663e4dec69c095f945f662d269e7f5b5795cd160b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:2268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads