3034efabb0240462e2919ac133ab27372337bae94ce1e75fb9b60cb7033f244e | Triage

Analysis

max time kernel
52s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
30-03-2022 09:10

Sharing

Report Analysis Logs

General

Target

3034efabb0240462e2919ac133ab27372337bae94ce1e75fb9b60cb7033f244e.exe
Size

78KB
MD5

10dc56c61c5df82374ded65e8520b09d
SHA1

b0b809fc1fdbfea6f1d9b3984ddbc1878a8c7c7a
SHA256

3034efabb0240462e2919ac133ab27372337bae94ce1e75fb9b60cb7033f244e
SHA512

4f9089deabe313db1e328f137344175d345fae47c36eb27995a8dade608e5d658ff626ff61bdc02a0d122ed919150e3842fd088733d873b2e17a63d630c68c77

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

3034efabb0240462e2919ac133ab27372337bae94ce1e75fb9b60cb7033f244e.exefondue.exe

description	pid	process	target process
PID 2176 wrote to memory of 5008	2176	3034efabb0240462e2919ac133ab27372337bae94ce1e75fb9b60cb7033f244e.exe	fondue.exe
PID 2176 wrote to memory of 5008	2176	3034efabb0240462e2919ac133ab27372337bae94ce1e75fb9b60cb7033f244e.exe	fondue.exe
PID 2176 wrote to memory of 5008	2176	3034efabb0240462e2919ac133ab27372337bae94ce1e75fb9b60cb7033f244e.exe	fondue.exe
PID 5008 wrote to memory of 4840	5008	fondue.exe	FonDUE.EXE
PID 5008 wrote to memory of 4840	5008	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\3034efabb0240462e2919ac133ab27372337bae94ce1e75fb9b60cb7033f244e.exe
"C:\Users\Admin\AppData\Local\Temp\3034efabb0240462e2919ac133ab27372337bae94ce1e75fb9b60cb7033f244e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:5008

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:4840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4840-125-0x0000000000000000-mapping.dmp

Download
memory/5008-124-0x0000000000000000-mapping.dmp

Download