f891bd59c1f20b763e196ab43a8579cb39e4aa9122f5dcf3cff0b4ef72b880e0 | Triage

Analysis

max time kernel
125s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
15-03-2022 14:31

Sharing

Report Analysis Logs

General

Target

f891bd59c1f20b763e196ab43a8579cb39e4aa9122f5dcf3cff0b4ef72b880e0.exe
Size

552KB
MD5

6ecbb3a6667cfa539b220a0e48067c5d
SHA1

3bd94922e5d70fdbf117a403a95047c471895e07
SHA256

f891bd59c1f20b763e196ab43a8579cb39e4aa9122f5dcf3cff0b4ef72b880e0
SHA512

eb727cba1ba6d34e28c6e050d18200bf4abff8b84cad2523238a3b04a9b6219b658567bf4850ea3f7cb01e2d11defd7306576110a3ff77665c5e61d22eb126f0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

f891bd59c1f20b763e196ab43a8579cb39e4aa9122f5dcf3cff0b4ef72b880e0.exefondue.exe

description	pid	process	target process
PID 3404 wrote to memory of 4884	3404	f891bd59c1f20b763e196ab43a8579cb39e4aa9122f5dcf3cff0b4ef72b880e0.exe	fondue.exe
PID 3404 wrote to memory of 4884	3404	f891bd59c1f20b763e196ab43a8579cb39e4aa9122f5dcf3cff0b4ef72b880e0.exe	fondue.exe
PID 3404 wrote to memory of 4884	3404	f891bd59c1f20b763e196ab43a8579cb39e4aa9122f5dcf3cff0b4ef72b880e0.exe	fondue.exe
PID 4884 wrote to memory of 4200	4884	fondue.exe	FonDUE.EXE
PID 4884 wrote to memory of 4200	4884	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\f891bd59c1f20b763e196ab43a8579cb39e4aa9122f5dcf3cff0b4ef72b880e0.exe
"C:\Users\Admin\AppData\Local\Temp\f891bd59c1f20b763e196ab43a8579cb39e4aa9122f5dcf3cff0b4ef72b880e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3404

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4884

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:4200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads