b67f8adf12ac9fc182d38bab985b4b020ec35f614cb4956f587738ff111b8dc5 | Triage

Analysis

max time kernel
137s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
14-03-2022 18:02

Sharing

Report Analysis Logs

General

Target

b67f8adf12ac9fc182d38bab985b4b020ec35f614cb4956f587738ff111b8dc5.exe
Size

553KB
MD5

d504f0c38156c93ec2cdde1b42677499
SHA1

1359c6b4b4e688935d56b12fd7aa3c541e57e177
SHA256

b67f8adf12ac9fc182d38bab985b4b020ec35f614cb4956f587738ff111b8dc5
SHA512

7272b6096ea19c5137042c64951f3571cc9c32de7008ed0474dd241e751c459d55b89aafdc15142a6899b2e14714a14acdad3144be6aa698580ee64dbbd21750

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

b67f8adf12ac9fc182d38bab985b4b020ec35f614cb4956f587738ff111b8dc5.exefondue.exe

description	pid	process	target process
PID 4516 wrote to memory of 2116	4516	b67f8adf12ac9fc182d38bab985b4b020ec35f614cb4956f587738ff111b8dc5.exe	fondue.exe
PID 4516 wrote to memory of 2116	4516	b67f8adf12ac9fc182d38bab985b4b020ec35f614cb4956f587738ff111b8dc5.exe	fondue.exe
PID 4516 wrote to memory of 2116	4516	b67f8adf12ac9fc182d38bab985b4b020ec35f614cb4956f587738ff111b8dc5.exe	fondue.exe
PID 2116 wrote to memory of 2304	2116	fondue.exe	FonDUE.EXE
PID 2116 wrote to memory of 2304	2116	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\b67f8adf12ac9fc182d38bab985b4b020ec35f614cb4956f587738ff111b8dc5.exe
"C:\Users\Admin\AppData\Local\Temp\b67f8adf12ac9fc182d38bab985b4b020ec35f614cb4956f587738ff111b8dc5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4516

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:2304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads