d6755588963d4091117811876f370f80a888e17da400e85587a1c3d2ae976bd8 | Triage

Analysis

max time kernel
131s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
14-03-2022 03:05

Sharing

Report Analysis Logs

General

Target

d6755588963d4091117811876f370f80a888e17da400e85587a1c3d2ae976bd8.exe
Size

552KB
MD5

c4fc8a63b52822187017399d82ccca2a
SHA1

2b940e48e3d41cfabdcde363411652e53181b257
SHA256

d6755588963d4091117811876f370f80a888e17da400e85587a1c3d2ae976bd8
SHA512

0a0134921e3b079ac49819c7917c619e675311882715f35d3799638c91c5e0352ebd4b294a1c44391576d67e966d7903094b98c91e30e3d3f77a7d5a74891aad

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

d6755588963d4091117811876f370f80a888e17da400e85587a1c3d2ae976bd8.exefondue.exe

description	pid	process	target process
PID 2380 wrote to memory of 2564	2380	d6755588963d4091117811876f370f80a888e17da400e85587a1c3d2ae976bd8.exe	fondue.exe
PID 2380 wrote to memory of 2564	2380	d6755588963d4091117811876f370f80a888e17da400e85587a1c3d2ae976bd8.exe	fondue.exe
PID 2380 wrote to memory of 2564	2380	d6755588963d4091117811876f370f80a888e17da400e85587a1c3d2ae976bd8.exe	fondue.exe
PID 2564 wrote to memory of 3092	2564	fondue.exe	FonDUE.EXE
PID 2564 wrote to memory of 3092	2564	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\d6755588963d4091117811876f370f80a888e17da400e85587a1c3d2ae976bd8.exe
"C:\Users\Admin\AppData\Local\Temp\d6755588963d4091117811876f370f80a888e17da400e85587a1c3d2ae976bd8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2564

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:3092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads