de94eba42bc864bb4b4c126cd4c33549e4f2f3dade6df44cca6380d74a85d441 | Triage

Analysis

max time kernel
100s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
14-03-2022 00:48

Sharing

Report Analysis Logs

General

Target

de94eba42bc864bb4b4c126cd4c33549e4f2f3dade6df44cca6380d74a85d441.exe
Size

552KB
MD5

4cf38e8027650b04328f649b08e0235a
SHA1

8842f751d29b1f694387f4889f73c7da70bcfc16
SHA256

de94eba42bc864bb4b4c126cd4c33549e4f2f3dade6df44cca6380d74a85d441
SHA512

9f4933892e82af424cef459de93749a2c780fc18e2d02881234db19ef962532e841c719dc1298a5eb3f96fa3f430a86d457b50750069b30d1523d2809c6e4e6b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

de94eba42bc864bb4b4c126cd4c33549e4f2f3dade6df44cca6380d74a85d441.exefondue.exe

description	pid	process	target process
PID 4828 wrote to memory of 1468	4828	de94eba42bc864bb4b4c126cd4c33549e4f2f3dade6df44cca6380d74a85d441.exe	fondue.exe
PID 4828 wrote to memory of 1468	4828	de94eba42bc864bb4b4c126cd4c33549e4f2f3dade6df44cca6380d74a85d441.exe	fondue.exe
PID 4828 wrote to memory of 1468	4828	de94eba42bc864bb4b4c126cd4c33549e4f2f3dade6df44cca6380d74a85d441.exe	fondue.exe
PID 1468 wrote to memory of 1664	1468	fondue.exe	FonDUE.EXE
PID 1468 wrote to memory of 1664	1468	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\de94eba42bc864bb4b4c126cd4c33549e4f2f3dade6df44cca6380d74a85d441.exe
"C:\Users\Admin\AppData\Local\Temp\de94eba42bc864bb4b4c126cd4c33549e4f2f3dade6df44cca6380d74a85d441.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4828

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads