9cf2f829f97acb5859464a3130fb2ecd9eeb03006ba17d0f6f3e3305d19e5826 | Triage

Analysis

max time kernel
81s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
29-03-2022 23:36

Sharing

Report Analysis Logs

General

Target

9cf2f829f97acb5859464a3130fb2ecd9eeb03006ba17d0f6f3e3305d19e5826.exe
Size

78KB
MD5

02f5520d2b448f25ad85e4ad4f0ea9e9
SHA1

c4db23e93244ec18847354ea2d2787ff65dfdd8e
SHA256

9cf2f829f97acb5859464a3130fb2ecd9eeb03006ba17d0f6f3e3305d19e5826
SHA512

d9d661af0f54c0d8c6949992474b29ba172199adf926b9018e3aeb213205ecf44613f86e93d031786d29012e80e78cf8cbc4de6034d5d0c45a87de5ef2c25945

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

9cf2f829f97acb5859464a3130fb2ecd9eeb03006ba17d0f6f3e3305d19e5826.exefondue.exe

description	pid	process	target process
PID 1596 wrote to memory of 2960	1596	9cf2f829f97acb5859464a3130fb2ecd9eeb03006ba17d0f6f3e3305d19e5826.exe	fondue.exe
PID 1596 wrote to memory of 2960	1596	9cf2f829f97acb5859464a3130fb2ecd9eeb03006ba17d0f6f3e3305d19e5826.exe	fondue.exe
PID 1596 wrote to memory of 2960	1596	9cf2f829f97acb5859464a3130fb2ecd9eeb03006ba17d0f6f3e3305d19e5826.exe	fondue.exe
PID 2960 wrote to memory of 1040	2960	fondue.exe	FonDUE.EXE
PID 2960 wrote to memory of 1040	2960	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\9cf2f829f97acb5859464a3130fb2ecd9eeb03006ba17d0f6f3e3305d19e5826.exe
"C:\Users\Admin\AppData\Local\Temp\9cf2f829f97acb5859464a3130fb2ecd9eeb03006ba17d0f6f3e3305d19e5826.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2960

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:1040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-125-0x0000000000000000-mapping.dmp

Download
memory/2960-124-0x0000000000000000-mapping.dmp

Download