f32362062c92cc8bc12495bea15537d79ec471da34883ddcd4d32b359128d89f | Triage

Analysis

max time kernel
152s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
13-03-2022 09:50

Sharing

Report Analysis Logs

General

Target

f32362062c92cc8bc12495bea15537d79ec471da34883ddcd4d32b359128d89f.exe
Size

553KB
MD5

6ed20654b3efedcd38640332a014c06a
SHA1

af5f6d51750b1052f4408e1e9c5c2e8b9460e8c6
SHA256

f32362062c92cc8bc12495bea15537d79ec471da34883ddcd4d32b359128d89f
SHA512

c1e92edd49722d74f928320b6d0405a272b96ce5a790a568de802176680fb85235161f65c7ee75f5afb56798009a9e15fd80a084437607caf8a77dc9294784ae

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

f32362062c92cc8bc12495bea15537d79ec471da34883ddcd4d32b359128d89f.exefondue.exe

description	pid	process	target process
PID 4056 wrote to memory of 4116	4056	f32362062c92cc8bc12495bea15537d79ec471da34883ddcd4d32b359128d89f.exe	fondue.exe
PID 4056 wrote to memory of 4116	4056	f32362062c92cc8bc12495bea15537d79ec471da34883ddcd4d32b359128d89f.exe	fondue.exe
PID 4056 wrote to memory of 4116	4056	f32362062c92cc8bc12495bea15537d79ec471da34883ddcd4d32b359128d89f.exe	fondue.exe
PID 4116 wrote to memory of 1944	4116	fondue.exe	FonDUE.EXE
PID 4116 wrote to memory of 1944	4116	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\f32362062c92cc8bc12495bea15537d79ec471da34883ddcd4d32b359128d89f.exe
"C:\Users\Admin\AppData\Local\Temp\f32362062c92cc8bc12495bea15537d79ec471da34883ddcd4d32b359128d89f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4056

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4116

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads