c9ffd4cffc24bc98ed738d63c2c332089b1da8688426ffec8ffdc6042a6cebb7 | Triage

Analysis

max time kernel
97s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
14-03-2022 12:23

Sharing

Report Analysis Logs

General

Target

c9ffd4cffc24bc98ed738d63c2c332089b1da8688426ffec8ffdc6042a6cebb7.exe
Size

556KB
MD5

e426879290dcc6f1218a98b8ec99f4b2
SHA1

b7b04374136d5efff82de0d9620c388ce2689fff
SHA256

c9ffd4cffc24bc98ed738d63c2c332089b1da8688426ffec8ffdc6042a6cebb7
SHA512

317748230e623d8ca6c79542b1f9339c4776d7927177a2e3f62634f9bf0d55b3795b841059389d8ed944648a0728e03593020002e1204d553831141fb1828ba5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

c9ffd4cffc24bc98ed738d63c2c332089b1da8688426ffec8ffdc6042a6cebb7.exefondue.exe

description	pid	process	target process
PID 4824 wrote to memory of 1264	4824	c9ffd4cffc24bc98ed738d63c2c332089b1da8688426ffec8ffdc6042a6cebb7.exe	fondue.exe
PID 4824 wrote to memory of 1264	4824	c9ffd4cffc24bc98ed738d63c2c332089b1da8688426ffec8ffdc6042a6cebb7.exe	fondue.exe
PID 4824 wrote to memory of 1264	4824	c9ffd4cffc24bc98ed738d63c2c332089b1da8688426ffec8ffdc6042a6cebb7.exe	fondue.exe
PID 1264 wrote to memory of 2552	1264	fondue.exe	FonDUE.EXE
PID 1264 wrote to memory of 2552	1264	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\c9ffd4cffc24bc98ed738d63c2c332089b1da8688426ffec8ffdc6042a6cebb7.exe
"C:\Users\Admin\AppData\Local\Temp\c9ffd4cffc24bc98ed738d63c2c332089b1da8688426ffec8ffdc6042a6cebb7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4824

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads