c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601 | Triage

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
16-03-2022 21:33

Sharing

Report Analysis Logs

General

Target

c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe
Size

2.5MB
MD5

9ef46e52f374eb55fcf8e8b56ade936a
SHA1

c103471fe52a01b9d0ab1f13f792354fa72f3c1f
SHA256

c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601
SHA512

56b96960b1d2af40eea1f75ffdbd5e34f900dc709d820f8b441600850a6310c167c4d2411b38facc49a698afbfb369da6d71682b87397204a4ae917b495629d0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exefondue.exe

description	pid	process	target process
PID 1012 wrote to memory of 3568	1012	c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe	fondue.exe
PID 1012 wrote to memory of 3568	1012	c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe	fondue.exe
PID 1012 wrote to memory of 3568	1012	c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe	fondue.exe
PID 3568 wrote to memory of 3932	3568	fondue.exe	FonDUE.EXE
PID 3568 wrote to memory of 3932	3568	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe
"C:\Users\Admin\AppData\Local\Temp\c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1012

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3568

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:3932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...