c22c4171a9ba3fae54bbda30f9dcc05e9067d4e30c1edad665eada464925ab54 | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
20-03-2022 01:42

Sharing

Report Analysis Logs

General

Target

c22c4171a9ba3fae54bbda30f9dcc05e9067d4e30c1edad665eada464925ab54.exe
Size

9.6MB
MD5

db6240c4f671154185b7d7b61d1059c9
SHA1

ac6af4f2e3709358c613242a4520d9f752ebf52c
SHA256

c22c4171a9ba3fae54bbda30f9dcc05e9067d4e30c1edad665eada464925ab54
SHA512

53d5901609fd3bd36492acc0ba0deaa960481037a9258736d10d42e389e1420e0b07a50a48655a537e374be1b1d64b9041238dc691fc710491b091fa99744efc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

c22c4171a9ba3fae54bbda30f9dcc05e9067d4e30c1edad665eada464925ab54.exe

description	pid	Process	procid_target
PID 2152 wrote to memory of 2364	2152	c22c4171a9ba3fae54bbda30f9dcc05e9067d4e30c1edad665eada464925ab54.exe	80
PID 2152 wrote to memory of 2364	2152	c22c4171a9ba3fae54bbda30f9dcc05e9067d4e30c1edad665eada464925ab54.exe	80

C:\Users\Admin\AppData\Local\Temp\c22c4171a9ba3fae54bbda30f9dcc05e9067d4e30c1edad665eada464925ab54.exe
"C:\Users\Admin\AppData\Local\Temp\c22c4171a9ba3fae54bbda30f9dcc05e9067d4e30c1edad665eada464925ab54.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\system32\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads