94100e5aa10700946bc196b704fb39d8857b3bb0ee9feef626b60abcc19d7e12 | Triage

Analysis

max time kernel
115s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
24-03-2022 19:31

Sharing

Report Analysis Logs

General

Target

94100e5aa10700946bc196b704fb39d8857b3bb0ee9feef626b60abcc19d7e12.exe
Size

65KB
MD5

13a4841e9114114472aaaf0e3faa1be0
SHA1

d9b1529c9c5d0257a7c68c8517ab3ae01ae535c9
SHA256

94100e5aa10700946bc196b704fb39d8857b3bb0ee9feef626b60abcc19d7e12
SHA512

69747c9efbd3e7845068f5b53413b625a284b54e01623ab3c7bd413b8561d0a31f5d8cdd506f280eb8a06dd0f6df0d8636fe87c5cdda5c914e46e6bf1b4eab39

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

94100e5aa10700946bc196b704fb39d8857b3bb0ee9feef626b60abcc19d7e12.exefondue.exe

description	pid	process	target process
PID 2308 wrote to memory of 3364	2308	94100e5aa10700946bc196b704fb39d8857b3bb0ee9feef626b60abcc19d7e12.exe	fondue.exe
PID 2308 wrote to memory of 3364	2308	94100e5aa10700946bc196b704fb39d8857b3bb0ee9feef626b60abcc19d7e12.exe	fondue.exe
PID 2308 wrote to memory of 3364	2308	94100e5aa10700946bc196b704fb39d8857b3bb0ee9feef626b60abcc19d7e12.exe	fondue.exe
PID 3364 wrote to memory of 932	3364	fondue.exe	FonDUE.EXE
PID 3364 wrote to memory of 932	3364	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\94100e5aa10700946bc196b704fb39d8857b3bb0ee9feef626b60abcc19d7e12.exe
"C:\Users\Admin\AppData\Local\Temp\94100e5aa10700946bc196b704fb39d8857b3bb0ee9feef626b60abcc19d7e12.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2308

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3364

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:932

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/932-135-0x0000000000000000-mapping.dmp

Download
memory/3364-134-0x0000000000000000-mapping.dmp

Download