ca8073cdeb4f3cca2e21faf93496b5fbabb6ebb3c42477ce0d7e6c077cedf93f | Triage

Analysis

max time kernel
132s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
14-03-2022 12:14

Sharing

Report Analysis Logs

General

Target

ca8073cdeb4f3cca2e21faf93496b5fbabb6ebb3c42477ce0d7e6c077cedf93f.exe
Size

552KB
MD5

1963a2ebcb06a50b355783ec0f2e6fee
SHA1

48b6b4a8ece0683e203727f34afe371b376b0dcf
SHA256

ca8073cdeb4f3cca2e21faf93496b5fbabb6ebb3c42477ce0d7e6c077cedf93f
SHA512

450ae811891338754af880886c62e4015dfff6f0376d1b42ef067e3f735afe478b0985a81c005096c58933181040b9d0cdd644610b1d7800f806cf10aa489eed

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

ca8073cdeb4f3cca2e21faf93496b5fbabb6ebb3c42477ce0d7e6c077cedf93f.exefondue.exe

description	pid	process	target process
PID 2576 wrote to memory of 2736	2576	ca8073cdeb4f3cca2e21faf93496b5fbabb6ebb3c42477ce0d7e6c077cedf93f.exe	fondue.exe
PID 2576 wrote to memory of 2736	2576	ca8073cdeb4f3cca2e21faf93496b5fbabb6ebb3c42477ce0d7e6c077cedf93f.exe	fondue.exe
PID 2576 wrote to memory of 2736	2576	ca8073cdeb4f3cca2e21faf93496b5fbabb6ebb3c42477ce0d7e6c077cedf93f.exe	fondue.exe
PID 2736 wrote to memory of 368	2736	fondue.exe	FonDUE.EXE
PID 2736 wrote to memory of 368	2736	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\ca8073cdeb4f3cca2e21faf93496b5fbabb6ebb3c42477ce0d7e6c077cedf93f.exe
"C:\Users\Admin\AppData\Local\Temp\ca8073cdeb4f3cca2e21faf93496b5fbabb6ebb3c42477ce0d7e6c077cedf93f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2576

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2736

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads