c7a6993d8af95d0a836627dd75ada4b7a369d0540d3cd572c382cfe4f4bab7e9 | Triage

Analysis

max time kernel
123s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
14-03-2022 13:04

Sharing

Report Analysis Logs

General

Target

c7a6993d8af95d0a836627dd75ada4b7a369d0540d3cd572c382cfe4f4bab7e9.exe
Size

552KB
MD5

3dd036e69122fabaab30f4614392178d
SHA1

0b9fb89252d7522ed179db4c4ba4ae2d92bbd81d
SHA256

c7a6993d8af95d0a836627dd75ada4b7a369d0540d3cd572c382cfe4f4bab7e9
SHA512

89d5c312b95b538bef0f39dbbc7aaac95d4f35d33e72c7a7e3db64ca4e51b853d7d24e92ae35db1cd5ecfdb742cc7e5ce284d939b3e3f0d82c5eae3acf5ff20d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

c7a6993d8af95d0a836627dd75ada4b7a369d0540d3cd572c382cfe4f4bab7e9.exefondue.exe

description	pid	process	target process
PID 4668 wrote to memory of 3264	4668	c7a6993d8af95d0a836627dd75ada4b7a369d0540d3cd572c382cfe4f4bab7e9.exe	fondue.exe
PID 4668 wrote to memory of 3264	4668	c7a6993d8af95d0a836627dd75ada4b7a369d0540d3cd572c382cfe4f4bab7e9.exe	fondue.exe
PID 4668 wrote to memory of 3264	4668	c7a6993d8af95d0a836627dd75ada4b7a369d0540d3cd572c382cfe4f4bab7e9.exe	fondue.exe
PID 3264 wrote to memory of 364	3264	fondue.exe	FonDUE.EXE
PID 3264 wrote to memory of 364	3264	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\c7a6993d8af95d0a836627dd75ada4b7a369d0540d3cd572c382cfe4f4bab7e9.exe
"C:\Users\Admin\AppData\Local\Temp\c7a6993d8af95d0a836627dd75ada4b7a369d0540d3cd572c382cfe4f4bab7e9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4668

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3264

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads