9d52541ddda963068ec5d8db9928958fa97b0e512acc3740968a888d0acad097 | Triage

Analysis

max time kernel
117s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
12-03-2022 04:34

Sharing

Report Analysis Logs

General

Target

9d52541ddda963068ec5d8db9928958fa97b0e512acc3740968a888d0acad097.exe
Size

553KB
MD5

2f18a51d25677a67164950bcd56a096b
SHA1

cb6a1769b90019f6fe6a8d5839b03fdfca5757d2
SHA256

9d52541ddda963068ec5d8db9928958fa97b0e512acc3740968a888d0acad097
SHA512

60c667e1c104e35b1c499c3aa5d98aeab53d413d3461801aa114366e8c821f4e37dfaf4e0ba1db62e8d00b58376c566fc687ebabb80c34552a6e4043912631e5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

9d52541ddda963068ec5d8db9928958fa97b0e512acc3740968a888d0acad097.exefondue.exe

description	pid	process	target process
PID 532 wrote to memory of 5036	532	9d52541ddda963068ec5d8db9928958fa97b0e512acc3740968a888d0acad097.exe	fondue.exe
PID 532 wrote to memory of 5036	532	9d52541ddda963068ec5d8db9928958fa97b0e512acc3740968a888d0acad097.exe	fondue.exe
PID 532 wrote to memory of 5036	532	9d52541ddda963068ec5d8db9928958fa97b0e512acc3740968a888d0acad097.exe	fondue.exe
PID 5036 wrote to memory of 4620	5036	fondue.exe	FonDUE.EXE
PID 5036 wrote to memory of 4620	5036	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\9d52541ddda963068ec5d8db9928958fa97b0e512acc3740968a888d0acad097.exe
"C:\Users\Admin\AppData\Local\Temp\9d52541ddda963068ec5d8db9928958fa97b0e512acc3740968a888d0acad097.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:532

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:5036

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:4620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads