c31d9d79d78039d830bdf92e36d8fe905237c883864a2ce795e97219eb64963f | Triage

Analysis

max time kernel
133s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
14-03-2022 14:22

Sharing

Report Analysis Logs

General

Target

c31d9d79d78039d830bdf92e36d8fe905237c883864a2ce795e97219eb64963f.exe
Size

552KB
MD5

498cf1b9adf3cf749e10b4dd624af0ce
SHA1

f6b7784c7adf568fc20fbb25d22a664d53abfbbe
SHA256

c31d9d79d78039d830bdf92e36d8fe905237c883864a2ce795e97219eb64963f
SHA512

1c6bf0d15dd17c69fb32cf0e3bedb45a1e34cd8c045340cbc94e1a0ee3ea85c01e5522acd05b57fc98ab5c8dcaa7d2b57319ccf28c88af19661fd6cc38957d36

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

c31d9d79d78039d830bdf92e36d8fe905237c883864a2ce795e97219eb64963f.exefondue.exe

description	pid	process	target process
PID 384 wrote to memory of 1096	384	c31d9d79d78039d830bdf92e36d8fe905237c883864a2ce795e97219eb64963f.exe	fondue.exe
PID 384 wrote to memory of 1096	384	c31d9d79d78039d830bdf92e36d8fe905237c883864a2ce795e97219eb64963f.exe	fondue.exe
PID 384 wrote to memory of 1096	384	c31d9d79d78039d830bdf92e36d8fe905237c883864a2ce795e97219eb64963f.exe	fondue.exe
PID 1096 wrote to memory of 1572	1096	fondue.exe	FonDUE.EXE
PID 1096 wrote to memory of 1572	1096	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\c31d9d79d78039d830bdf92e36d8fe905237c883864a2ce795e97219eb64963f.exe
"C:\Users\Admin\AppData\Local\Temp\c31d9d79d78039d830bdf92e36d8fe905237c883864a2ce795e97219eb64963f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:384

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:1572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads