ee790d6f09c2292d457cbe92729937e06b3e21eb6b212bf2e32386ba7c2ff22c | Triage

Analysis

max time kernel
104s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
13-03-2022 11:03

Sharing

Report Analysis Logs

General

Target

ee790d6f09c2292d457cbe92729937e06b3e21eb6b212bf2e32386ba7c2ff22c.exe
Size

560KB
MD5

30ae8004a14f188d40c024124022d63d
SHA1

187d7cc1f90d54c1b7cf87f88a68e196cb2067e2
SHA256

ee790d6f09c2292d457cbe92729937e06b3e21eb6b212bf2e32386ba7c2ff22c
SHA512

97a41bd2e44cc927b0c89bad7a6ac37b8785de4b2bc8637d2707a51674efb08889de40d4d8b2c139f15ed2862b885285bcf3eb832bd148411525b7530babbb2b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

ee790d6f09c2292d457cbe92729937e06b3e21eb6b212bf2e32386ba7c2ff22c.exefondue.exe

description	pid	process	target process
PID 4844 wrote to memory of 1468	4844	ee790d6f09c2292d457cbe92729937e06b3e21eb6b212bf2e32386ba7c2ff22c.exe	fondue.exe
PID 4844 wrote to memory of 1468	4844	ee790d6f09c2292d457cbe92729937e06b3e21eb6b212bf2e32386ba7c2ff22c.exe	fondue.exe
PID 4844 wrote to memory of 1468	4844	ee790d6f09c2292d457cbe92729937e06b3e21eb6b212bf2e32386ba7c2ff22c.exe	fondue.exe
PID 1468 wrote to memory of 5100	1468	fondue.exe	FonDUE.EXE
PID 1468 wrote to memory of 5100	1468	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\ee790d6f09c2292d457cbe92729937e06b3e21eb6b212bf2e32386ba7c2ff22c.exe
"C:\Users\Admin\AppData\Local\Temp\ee790d6f09c2292d457cbe92729937e06b3e21eb6b212bf2e32386ba7c2ff22c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4844

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:5100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads