771f06f83944bc4f6c58e8766dda5717325edc73b425860167c64c4e9e35e74d | Triage

Analysis

max time kernel
39s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
27-03-2022 01:12

Sharing

Report Analysis Logs

General

Target

771f06f83944bc4f6c58e8766dda5717325edc73b425860167c64c4e9e35e74d.exe
Size

9.7MB
MD5

5de383a351746f1bd2d21173746b6807
SHA1

1daf7a4826d10c5c549420055fa234c0492ef8a5
SHA256

771f06f83944bc4f6c58e8766dda5717325edc73b425860167c64c4e9e35e74d
SHA512

e215247f00a73944ec3b4c687a3c362502bb383655732d5fae820449466d9e0326417af54ddf009910ec5bb203d75f01052e3babf8e97baa3184699f7b886cc4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

771f06f83944bc4f6c58e8766dda5717325edc73b425860167c64c4e9e35e74d.exe

description	pid	process	target process
PID 5016 wrote to memory of 1276	5016	771f06f83944bc4f6c58e8766dda5717325edc73b425860167c64c4e9e35e74d.exe	fondue.exe
PID 5016 wrote to memory of 1276	5016	771f06f83944bc4f6c58e8766dda5717325edc73b425860167c64c4e9e35e74d.exe	fondue.exe

C:\Users\Admin\AppData\Local\Temp\771f06f83944bc4f6c58e8766dda5717325edc73b425860167c64c4e9e35e74d.exe
"C:\Users\Admin\AppData\Local\Temp\771f06f83944bc4f6c58e8766dda5717325edc73b425860167c64c4e9e35e74d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\system32\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  PID:1276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-124-0x0000000000000000-mapping.dmp

Download