177eb704df67eb4982a6f125fb2b57342e80db27f9bfeea8ff76d8e8ef318801

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 01:05

Target

resources/binaries/blitz_fortnite.dll
Size

3.6MB
MD5

36fff46b4bb4d4da458b679ac796a22f
SHA1

5595216100053e5741f0dc87307583c65c430691
SHA256

487ff9af9805924e1cb6b5721547adb4c9fa9149339af3c76db3e3870cd2381c
SHA512

060bfe409b390aa8fda1d2278bf51a5623e6976b39dbb51acba8f7f631d4fcbe54345e6b71980a550f54af1df0220512756d54a5068187c7d3511e0ec7d0fc12
SSDEEP

49152:mKcX5Z15fNpr0W+by0k1CWCNTOxFv8PMjy/UvYna3rB+P2OQyXmkTiZG8:hWqyOoY0jyu02WXmkTWG8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2308	2264	rundll32.exe	28
PID 2264 wrote to memory of 2308	2264	rundll32.exe	28
PID 2264 wrote to memory of 2308	2264	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\binaries\blitz_fortnite.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2264 -s 116
  2⤵
  PID:2308