763fc4b26e62c282d2c3dc30b50357c4b99d9d2982aafa70b749430d3916e738 | Triage

Analysis

max time kernel
48s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
30-03-2022 03:35

Sharing

Report Analysis Logs

General

Target

763fc4b26e62c282d2c3dc30b50357c4b99d9d2982aafa70b749430d3916e738.exe
Size

78KB
MD5

016f7f4cdd91ff5da68185b7492e7457
SHA1

ff2d20723a34b92ca4f5b8b1cd0e1edff633b5bb
SHA256

763fc4b26e62c282d2c3dc30b50357c4b99d9d2982aafa70b749430d3916e738
SHA512

ee6308f4cb87605c190461038fc7d70315374f5d8535ec576d8f9b3995aba1d1918116f53759602b9f8f2d52f7269100466c15a26ca94d1f599f99b7bde4224e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

763fc4b26e62c282d2c3dc30b50357c4b99d9d2982aafa70b749430d3916e738.exefondue.exe

description	pid	process	target process
PID 3944 wrote to memory of 1448	3944	763fc4b26e62c282d2c3dc30b50357c4b99d9d2982aafa70b749430d3916e738.exe	fondue.exe
PID 3944 wrote to memory of 1448	3944	763fc4b26e62c282d2c3dc30b50357c4b99d9d2982aafa70b749430d3916e738.exe	fondue.exe
PID 3944 wrote to memory of 1448	3944	763fc4b26e62c282d2c3dc30b50357c4b99d9d2982aafa70b749430d3916e738.exe	fondue.exe
PID 1448 wrote to memory of 2836	1448	fondue.exe	FonDUE.EXE
PID 1448 wrote to memory of 2836	1448	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\763fc4b26e62c282d2c3dc30b50357c4b99d9d2982aafa70b749430d3916e738.exe
"C:\Users\Admin\AppData\Local\Temp\763fc4b26e62c282d2c3dc30b50357c4b99d9d2982aafa70b749430d3916e738.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3944

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1448-124-0x0000000000000000-mapping.dmp

Download
memory/2836-125-0x0000000000000000-mapping.dmp

Download