e861470fc6173cda004b16e48c9aea6eaba9a714a7f60f9235d4fe260bd92e92 | Triage

Analysis

max time kernel
138s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
13/03/2022, 18:58

Sharing

Report Analysis Logs

General

Target

e861470fc6173cda004b16e48c9aea6eaba9a714a7f60f9235d4fe260bd92e92.exe
Size

1.7MB
MD5

935a7eb2744b6e32408bfce6148ece45
SHA1

9000f3663647c242eaea96691cf741a3ed45d284
SHA256

e861470fc6173cda004b16e48c9aea6eaba9a714a7f60f9235d4fe260bd92e92
SHA512

ce3182c2e9705fa60f7cdaa3893e0c8ac0639218dcb4beae07b909f976360fab744e9535e20c15a5255d927086a360faac76f3f1268c733bbcc4223a36a953e3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 4444	4472	e861470fc6173cda004b16e48c9aea6eaba9a714a7f60f9235d4fe260bd92e92.exe	82
PID 4472 wrote to memory of 4444	4472	e861470fc6173cda004b16e48c9aea6eaba9a714a7f60f9235d4fe260bd92e92.exe	82

C:\Users\Admin\AppData\Local\Temp\e861470fc6173cda004b16e48c9aea6eaba9a714a7f60f9235d4fe260bd92e92.exe
"C:\Users\Admin\AppData\Local\Temp\e861470fc6173cda004b16e48c9aea6eaba9a714a7f60f9235d4fe260bd92e92.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\system32\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  PID:4444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads