de6e3a18158cf76909a5b39996ac3b1231aa336e9715ec92451a00fd972e10b7 | Triage

Analysis

max time kernel
117s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
14-03-2022 00:50

Sharing

Report Analysis Logs

General

Target

de6e3a18158cf76909a5b39996ac3b1231aa336e9715ec92451a00fd972e10b7.exe
Size

552KB
MD5

e6a57cad9a7f340a0f1eba302f942c9e
SHA1

936249c0e6984a59ad8da4a7340e95f5c6902e70
SHA256

de6e3a18158cf76909a5b39996ac3b1231aa336e9715ec92451a00fd972e10b7
SHA512

afff394ac4ffae6657875eb575b1b050109a30e794ad639e06e8edbc0da99bf645e751082b2e333775c9fce86172bd665c1b8a59462a7255927c8cd135426d84

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

de6e3a18158cf76909a5b39996ac3b1231aa336e9715ec92451a00fd972e10b7.exefondue.exe

description	pid	process	target process
PID 4664 wrote to memory of 4652	4664	de6e3a18158cf76909a5b39996ac3b1231aa336e9715ec92451a00fd972e10b7.exe	fondue.exe
PID 4664 wrote to memory of 4652	4664	de6e3a18158cf76909a5b39996ac3b1231aa336e9715ec92451a00fd972e10b7.exe	fondue.exe
PID 4664 wrote to memory of 4652	4664	de6e3a18158cf76909a5b39996ac3b1231aa336e9715ec92451a00fd972e10b7.exe	fondue.exe
PID 4652 wrote to memory of 4576	4652	fondue.exe	FonDUE.EXE
PID 4652 wrote to memory of 4576	4652	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\de6e3a18158cf76909a5b39996ac3b1231aa336e9715ec92451a00fd972e10b7.exe
"C:\Users\Admin\AppData\Local\Temp\de6e3a18158cf76909a5b39996ac3b1231aa336e9715ec92451a00fd972e10b7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4664

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4652

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:4576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads