9d0f8c1810c8a43925a45a1472d6c36d276d1b09b4fb8539d1452ba614800b88 | Triage

Analysis

max time kernel
123s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
12-03-2022 04:39

Sharing

Report Analysis Logs

General

Target

9d0f8c1810c8a43925a45a1472d6c36d276d1b09b4fb8539d1452ba614800b88.exe
Size

556KB
MD5

12f431cf3ead4b5fa698d9429f454f62
SHA1

5d7802a34aab9d38c8651e086a6fc26122a68b02
SHA256

9d0f8c1810c8a43925a45a1472d6c36d276d1b09b4fb8539d1452ba614800b88
SHA512

794543a45e2b2ccf1efff1349919618fc104b6dd945e588241d508ff07398b95c392e0b5311f210d4c06b5c06a7ca5ad54a9c22eaba07dd432fa928c0c8604a4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

9d0f8c1810c8a43925a45a1472d6c36d276d1b09b4fb8539d1452ba614800b88.exefondue.exe

description	pid	process	target process
PID 1496 wrote to memory of 4512	1496	9d0f8c1810c8a43925a45a1472d6c36d276d1b09b4fb8539d1452ba614800b88.exe	fondue.exe
PID 1496 wrote to memory of 4512	1496	9d0f8c1810c8a43925a45a1472d6c36d276d1b09b4fb8539d1452ba614800b88.exe	fondue.exe
PID 1496 wrote to memory of 4512	1496	9d0f8c1810c8a43925a45a1472d6c36d276d1b09b4fb8539d1452ba614800b88.exe	fondue.exe
PID 4512 wrote to memory of 2752	4512	fondue.exe	FonDUE.EXE
PID 4512 wrote to memory of 2752	4512	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\9d0f8c1810c8a43925a45a1472d6c36d276d1b09b4fb8539d1452ba614800b88.exe
"C:\Users\Admin\AppData\Local\Temp\9d0f8c1810c8a43925a45a1472d6c36d276d1b09b4fb8539d1452ba614800b88.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4512

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads