a03265120455f990fb05315ce049ed641c7fb5a62a07e29d904e53f4df5a7b24 | Triage

Analysis

max time kernel
124s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
12-03-2022 03:44

Sharing

Report Analysis Logs

General

Target

a03265120455f990fb05315ce049ed641c7fb5a62a07e29d904e53f4df5a7b24.exe
Size

552KB
MD5

9bc01aec43d14db349fae9a179f78f46
SHA1

036efd5ee8f97e50909ec23c7e893d05d972b0e0
SHA256

a03265120455f990fb05315ce049ed641c7fb5a62a07e29d904e53f4df5a7b24
SHA512

3d664a27fd7c9c173b2d3badd965c547f859559036fbeae4c144c0ee8ed5767694b2bf6daa9b122a9c2a80a8ac5f1c125c4ede8e8a2fbaed46cd89fa2cc1b185

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

a03265120455f990fb05315ce049ed641c7fb5a62a07e29d904e53f4df5a7b24.exefondue.exe

description	pid	process	target process
PID 4472 wrote to memory of 4524	4472	a03265120455f990fb05315ce049ed641c7fb5a62a07e29d904e53f4df5a7b24.exe	fondue.exe
PID 4472 wrote to memory of 4524	4472	a03265120455f990fb05315ce049ed641c7fb5a62a07e29d904e53f4df5a7b24.exe	fondue.exe
PID 4472 wrote to memory of 4524	4472	a03265120455f990fb05315ce049ed641c7fb5a62a07e29d904e53f4df5a7b24.exe	fondue.exe
PID 4524 wrote to memory of 3048	4524	fondue.exe	FonDUE.EXE
PID 4524 wrote to memory of 3048	4524	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\a03265120455f990fb05315ce049ed641c7fb5a62a07e29d904e53f4df5a7b24.exe
"C:\Users\Admin\AppData\Local\Temp\a03265120455f990fb05315ce049ed641c7fb5a62a07e29d904e53f4df5a7b24.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4472

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4524

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads