b017cdb6f137cd3e72e7524470ebf2ff2712cc5f78db58d6eb87b15b4a84184f | Triage™

Analysis

max time kernel
146s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
06/04/2022, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
B017CDB6F137CD3E72E7524470EBF2FF2712CC5F78DB5.exe
Size 2.4MB
Sample220406-bb2xcsfgh2
SHA256 b017cdb6f137cd3e72e7524470ebf2ff2712cc5f78db58d6eb87b15b4a84184f
MD5 79bb3776371472c8a14897893c2c17e3
SHA1 8aa42ff563940254ed39e8397e08bb2a2a91fdd6
SHA512 520b20e965cf72f4dc825f6780a0e0640cc206521acc51c118cb39cba3d619fb74c0dec9f18c0640ecb7c7c707d89615ec54374f732ef237304df985135a756c
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1924	2032	B017CDB6F137CD3E72E7524470EBF2FF2712CC5F78DB5.exe	80
PID 2032 wrote to memory of 1924	2032	B017CDB6F137CD3E72E7524470EBF2FF2712CC5F78DB5.exe	80

C:\Users\Admin\AppData\Local\Temp\B017CDB6F137CD3E72E7524470EBF2FF2712CC5F78DB5.exe
"C:\Users\Admin\AppData\Local\Temp\B017CDB6F137CD3E72E7524470EBF2FF2712CC5F78DB5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\system32\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  PID:1924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads