9c04b7ba30ba22c5f878d23b29f6fd492a5bfa6da831ef0707cc73908cda3988 | Triage

Analysis

max time kernel
53s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
12-03-2022 04:58

Sharing

Report Analysis Logs

General

Target

9c04b7ba30ba22c5f878d23b29f6fd492a5bfa6da831ef0707cc73908cda3988.exe
Size

552KB
MD5

2161bf50926660d37a76f6700c3b49f8
SHA1

745bbe9768125245d64f250cb16f63327f8e0240
SHA256

9c04b7ba30ba22c5f878d23b29f6fd492a5bfa6da831ef0707cc73908cda3988
SHA512

c0d7f5ca70bc5aed35f00cc5df37160f5a370dc280c54604e22a607ecb9158b5306f45593a350b43cc44d94dd7ee5406a1ea5f87aebbea485c48417cfed4b75c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

9c04b7ba30ba22c5f878d23b29f6fd492a5bfa6da831ef0707cc73908cda3988.exefondue.exe

description	pid	process	target process
PID 1708 wrote to memory of 2376	1708	9c04b7ba30ba22c5f878d23b29f6fd492a5bfa6da831ef0707cc73908cda3988.exe	fondue.exe
PID 1708 wrote to memory of 2376	1708	9c04b7ba30ba22c5f878d23b29f6fd492a5bfa6da831ef0707cc73908cda3988.exe	fondue.exe
PID 1708 wrote to memory of 2376	1708	9c04b7ba30ba22c5f878d23b29f6fd492a5bfa6da831ef0707cc73908cda3988.exe	fondue.exe
PID 2376 wrote to memory of 2832	2376	fondue.exe	FonDUE.EXE
PID 2376 wrote to memory of 2832	2376	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\9c04b7ba30ba22c5f878d23b29f6fd492a5bfa6da831ef0707cc73908cda3988.exe
"C:\Users\Admin\AppData\Local\Temp\9c04b7ba30ba22c5f878d23b29f6fd492a5bfa6da831ef0707cc73908cda3988.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2376

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads