113d72ee9b8799d507cde23c44fa2b97e31dbbb141f2c8d6b0bdd157da628c66 | Triage

Analysis

max time kernel
52s
max time network
86s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
30-03-2022 02:11

Sharing

Report Analysis Logs

General

Target

113d72ee9b8799d507cde23c44fa2b97e31dbbb141f2c8d6b0bdd157da628c66.exe
Size

1.2MB
MD5

9b2734137accced6a1c34e28ffe9e907
SHA1

11de47bc139e4232eb6933075a457e2782fbecd8
SHA256

113d72ee9b8799d507cde23c44fa2b97e31dbbb141f2c8d6b0bdd157da628c66
SHA512

eb52ceb42180215d85c2ddaf72a60ab1346c267b0ef9ca25fbc1ad15d766f6097cec432a84f06555b7dfc11a7c6dcec3aac75cad5d15e117c8e37eeda6215e9d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

113d72ee9b8799d507cde23c44fa2b97e31dbbb141f2c8d6b0bdd157da628c66.exefondue.exe

description	pid	process	target process
PID 4520 wrote to memory of 3352	4520	113d72ee9b8799d507cde23c44fa2b97e31dbbb141f2c8d6b0bdd157da628c66.exe	fondue.exe
PID 4520 wrote to memory of 3352	4520	113d72ee9b8799d507cde23c44fa2b97e31dbbb141f2c8d6b0bdd157da628c66.exe	fondue.exe
PID 4520 wrote to memory of 3352	4520	113d72ee9b8799d507cde23c44fa2b97e31dbbb141f2c8d6b0bdd157da628c66.exe	fondue.exe
PID 3352 wrote to memory of 1128	3352	fondue.exe	FonDUE.EXE
PID 3352 wrote to memory of 1128	3352	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\113d72ee9b8799d507cde23c44fa2b97e31dbbb141f2c8d6b0bdd157da628c66.exe
"C:\Users\Admin\AppData\Local\Temp\113d72ee9b8799d507cde23c44fa2b97e31dbbb141f2c8d6b0bdd157da628c66.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4520

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3352

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:1128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1128-125-0x0000000000000000-mapping.dmp

Download
memory/3352-124-0x0000000000000000-mapping.dmp

Download