cfe4611fae816c13dc9659536964dc59c40aa4d65745c2557072076bbd7883f4 | Triage™

Analysis

max time kernel
136s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
29/03/2022, 19:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cfe4611fae816c13dc9659536964dc59c40aa4d65745c2557072076bbd7883f4.exe
Size 1.0MB
Sample220329-xxlyxsecbl
SHA256 cfe4611fae816c13dc9659536964dc59c40aa4d65745c2557072076bbd7883f4
MD5 b3e5cbefad6e9dcd6ed9734e25db53aa
SHA1 62b8b0e50f3fafcc870170f7547c42a423d51db1
SHA512 1d894134b447e3aad8a055a895f341ead2aedb8a8952a7b6eaa8542eb4e8ac57732d95834b1de78a29e53a2662c81f725b6b09c0fa28416f61f51d96d9f4d6a1
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 940	2924	cfe4611fae816c13dc9659536964dc59c40aa4d65745c2557072076bbd7883f4.exe	79
PID 2924 wrote to memory of 940	2924	cfe4611fae816c13dc9659536964dc59c40aa4d65745c2557072076bbd7883f4.exe	79

C:\Users\Admin\AppData\Local\Temp\cfe4611fae816c13dc9659536964dc59c40aa4d65745c2557072076bbd7883f4.exe
"C:\Users\Admin\AppData\Local\Temp\cfe4611fae816c13dc9659536964dc59c40aa4d65745c2557072076bbd7883f4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\system32\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  PID:940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads