75028b8f62067e103aeda12fb97b3f99404e7a9a12bbb4525e3e3a8f9fbe5f3f | Triage

Analysis

max time kernel
57s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
30-03-2022 03:44

Sharing

Report Analysis Logs

General

Target

75028b8f62067e103aeda12fb97b3f99404e7a9a12bbb4525e3e3a8f9fbe5f3f.exe
Size

78KB
MD5

00b01e3ae42a148b96973f119918429e
SHA1

6c07708b750ff2e650ab3845544b138b65a597c4
SHA256

75028b8f62067e103aeda12fb97b3f99404e7a9a12bbb4525e3e3a8f9fbe5f3f
SHA512

899d5fabfa77d237e533615b10bd659965ffd212f015e6a8dbf6bd729a0c0b0af29a05db41721182987ffdd8dd1be72cb352577c53baf12fd49280fe62b338a0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

75028b8f62067e103aeda12fb97b3f99404e7a9a12bbb4525e3e3a8f9fbe5f3f.exefondue.exe

description	pid	process	target process
PID 2952 wrote to memory of 3932	2952	75028b8f62067e103aeda12fb97b3f99404e7a9a12bbb4525e3e3a8f9fbe5f3f.exe	fondue.exe
PID 2952 wrote to memory of 3932	2952	75028b8f62067e103aeda12fb97b3f99404e7a9a12bbb4525e3e3a8f9fbe5f3f.exe	fondue.exe
PID 2952 wrote to memory of 3932	2952	75028b8f62067e103aeda12fb97b3f99404e7a9a12bbb4525e3e3a8f9fbe5f3f.exe	fondue.exe
PID 3932 wrote to memory of 3596	3932	fondue.exe	FonDUE.EXE
PID 3932 wrote to memory of 3596	3932	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\75028b8f62067e103aeda12fb97b3f99404e7a9a12bbb4525e3e3a8f9fbe5f3f.exe
"C:\Users\Admin\AppData\Local\Temp\75028b8f62067e103aeda12fb97b3f99404e7a9a12bbb4525e3e3a8f9fbe5f3f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3932

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:3596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3596-125-0x0000000000000000-mapping.dmp

Download
memory/3932-124-0x0000000000000000-mapping.dmp

Download