bfc6e45698b47266eabc27eb8fe9373994557bd716535fa6a3f4dc1c37104482 | Triage

Analysis

max time kernel
125s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
29-03-2022 19:39

Sharing

Report Analysis Logs

General

Target

bfc6e45698b47266eabc27eb8fe9373994557bd716535fa6a3f4dc1c37104482.exe
Size

78KB
MD5

01e331a399bb6dc2647bb28a0b034078
SHA1

0c29521dc433c454d493b1e34fd06fddb8d47f5c
SHA256

bfc6e45698b47266eabc27eb8fe9373994557bd716535fa6a3f4dc1c37104482
SHA512

fe4160d73f2f963beeb6940c175b6bfa1c986a204b1dd3e8d56d4a67e48e7eb75752ca45d4a5c7e2a55867a48497690caa5ce4f3ef732b31f6cdc5d57afbf953

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

bfc6e45698b47266eabc27eb8fe9373994557bd716535fa6a3f4dc1c37104482.exefondue.exe

description	pid	process	target process
PID 4472 wrote to memory of 4184	4472	bfc6e45698b47266eabc27eb8fe9373994557bd716535fa6a3f4dc1c37104482.exe	fondue.exe
PID 4472 wrote to memory of 4184	4472	bfc6e45698b47266eabc27eb8fe9373994557bd716535fa6a3f4dc1c37104482.exe	fondue.exe
PID 4472 wrote to memory of 4184	4472	bfc6e45698b47266eabc27eb8fe9373994557bd716535fa6a3f4dc1c37104482.exe	fondue.exe
PID 4184 wrote to memory of 364	4184	fondue.exe	FonDUE.EXE
PID 4184 wrote to memory of 364	4184	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\bfc6e45698b47266eabc27eb8fe9373994557bd716535fa6a3f4dc1c37104482.exe
"C:\Users\Admin\AppData\Local\Temp\bfc6e45698b47266eabc27eb8fe9373994557bd716535fa6a3f4dc1c37104482.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4472

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4184

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-135-0x0000000000000000-mapping.dmp

Download
memory/4184-134-0x0000000000000000-mapping.dmp

Download