6257ab26547f390bfd67d60766a708a95998452eb487d6d7208a52dc3e9840e0 | Triage

Analysis

max time kernel
134s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
25-03-2022 22:01

Sharing

Report Analysis Logs

General

Target

6257ab26547f390bfd67d60766a708a95998452eb487d6d7208a52dc3e9840e0.exe
Size

270KB
MD5

db12a808823a93d95a2eb9719e0e5122
SHA1

5e2dcbddfd28c41bc6da89c3bbf1a9ac20b1080b
SHA256

6257ab26547f390bfd67d60766a708a95998452eb487d6d7208a52dc3e9840e0
SHA512

9817834daf4021b2510950ec1db6f9f905d122e1453ea170e9b9ef3c79c3871afcecfa6fd0a7937815c84a187250beca6102ef4d81a77ddff931a527407c4262

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1704	1596	6257ab26547f390bfd67d60766a708a95998452eb487d6d7208a52dc3e9840e0.exe	80
PID 1596 wrote to memory of 1704	1596	6257ab26547f390bfd67d60766a708a95998452eb487d6d7208a52dc3e9840e0.exe	80

C:\Users\Admin\AppData\Local\Temp\6257ab26547f390bfd67d60766a708a95998452eb487d6d7208a52dc3e9840e0.exe
"C:\Users\Admin\AppData\Local\Temp\6257ab26547f390bfd67d60766a708a95998452eb487d6d7208a52dc3e9840e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\system32\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads