c6dca612733df58acbb44521906203c0720bd0a74b553ebf44864edf938fe377 | Triage

Analysis

max time kernel
133s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
14-03-2022 13:17

Sharing

Report Analysis Logs

General

Target

c6dca612733df58acbb44521906203c0720bd0a74b553ebf44864edf938fe377.exe
Size

552KB
MD5

88c5d1b523842958a8f618e8fd1ca40d
SHA1

a0dcaf8db3fe12902827a4feef40486a5edd92e9
SHA256

c6dca612733df58acbb44521906203c0720bd0a74b553ebf44864edf938fe377
SHA512

da9ae58ab8218982462f324505b906d19addde8b0da20bfc0dff80b58adb6dcae0614e77e0ba6df74c9d43edc5ee1ffc5557831f20c968e8f7e87b7c3ae3c4af

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

c6dca612733df58acbb44521906203c0720bd0a74b553ebf44864edf938fe377.exefondue.exe

description	pid	process	target process
PID 1232 wrote to memory of 1432	1232	c6dca612733df58acbb44521906203c0720bd0a74b553ebf44864edf938fe377.exe	fondue.exe
PID 1232 wrote to memory of 1432	1232	c6dca612733df58acbb44521906203c0720bd0a74b553ebf44864edf938fe377.exe	fondue.exe
PID 1232 wrote to memory of 1432	1232	c6dca612733df58acbb44521906203c0720bd0a74b553ebf44864edf938fe377.exe	fondue.exe
PID 1432 wrote to memory of 1988	1432	fondue.exe	FonDUE.EXE
PID 1432 wrote to memory of 1988	1432	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\c6dca612733df58acbb44521906203c0720bd0a74b553ebf44864edf938fe377.exe
"C:\Users\Admin\AppData\Local\Temp\c6dca612733df58acbb44521906203c0720bd0a74b553ebf44864edf938fe377.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1232

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1432

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads