dac34a584f289e392fadb3edf51f52463a7c50a7c088ea392e712eba6a26f76d | Triage

Analysis

max time kernel
117s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
14-03-2022 01:47

Sharing

Report Analysis Logs

General

Target

dac34a584f289e392fadb3edf51f52463a7c50a7c088ea392e712eba6a26f76d.exe
Size

552KB
MD5

c0804c215cd82e53242d31fcd5d39e86
SHA1

3a007500216eb82920927853b2e281a501849433
SHA256

dac34a584f289e392fadb3edf51f52463a7c50a7c088ea392e712eba6a26f76d
SHA512

18fef0a5a0beedeeaeb85ac2e711b6102858a4deeb8370f91b8314c3671aa7ba7d971c3158940a79895bfd4ef438848d14faf43742ce0ccfb8312ee946d629b2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

dac34a584f289e392fadb3edf51f52463a7c50a7c088ea392e712eba6a26f76d.exefondue.exe

description	pid	process	target process
PID 532 wrote to memory of 5032	532	dac34a584f289e392fadb3edf51f52463a7c50a7c088ea392e712eba6a26f76d.exe	fondue.exe
PID 532 wrote to memory of 5032	532	dac34a584f289e392fadb3edf51f52463a7c50a7c088ea392e712eba6a26f76d.exe	fondue.exe
PID 532 wrote to memory of 5032	532	dac34a584f289e392fadb3edf51f52463a7c50a7c088ea392e712eba6a26f76d.exe	fondue.exe
PID 5032 wrote to memory of 4500	5032	fondue.exe	FonDUE.EXE
PID 5032 wrote to memory of 4500	5032	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\dac34a584f289e392fadb3edf51f52463a7c50a7c088ea392e712eba6a26f76d.exe
"C:\Users\Admin\AppData\Local\Temp\dac34a584f289e392fadb3edf51f52463a7c50a7c088ea392e712eba6a26f76d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:532

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:5032

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:4500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads