2dbf25db010361831baef17f92285d2efb32af12e064d80cc3037937fe228e69

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 18:36

Target

orqur - fortnite.exe
Size

6.6MB
MD5

8f10ad3ec661c6f442e7fad625c1bbac
SHA1

506db2cb55ca0f04e4d535d8e0f8293511d147a6
SHA256

2dbf25db010361831baef17f92285d2efb32af12e064d80cc3037937fe228e69
SHA512

98c10f100e974e8ee32419b00d12f17eedf681ae686cb6f30fcf844202bf664f94732f81aa2bf0a0f2691a24840179f7b31b58131c4f83883f361cae303f51a5
SSDEEP

98304:Jen1Kvlahp1Z9hzBLzzbMXYlXYxnCg2j5scrNws9ZiH/MctRkCgL4b3Q6V:nvl81Z1zYXYUne5scrNwfVkvL4Q6

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 4440	5112	orqur - fortnite.exe	83
PID 5112 wrote to memory of 4440	5112	orqur - fortnite.exe	83
PID 4440 wrote to memory of 400	4440	cmd.exe	84
PID 4440 wrote to memory of 400	4440	cmd.exe	84
PID 4440 wrote to memory of 4864	4440	cmd.exe	85
PID 4440 wrote to memory of 4864	4440	cmd.exe	85
PID 4440 wrote to memory of 4056	4440	cmd.exe	86
PID 4440 wrote to memory of 4056	4440	cmd.exe	86
PID 5112 wrote to memory of 4540	5112	orqur - fortnite.exe	87
PID 5112 wrote to memory of 4540	5112	orqur - fortnite.exe	87
PID 5112 wrote to memory of 2252	5112	orqur - fortnite.exe	88
PID 5112 wrote to memory of 2252	5112	orqur - fortnite.exe	88
PID 5112 wrote to memory of 4292	5112	orqur - fortnite.exe	89
PID 5112 wrote to memory of 4292	5112	orqur - fortnite.exe	89

C:\Users\Admin\AppData\Local\Temp\orqur - fortnite.exe
"C:\Users\Admin\AppData\Local\Temp\orqur - fortnite.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\orqur - fortnite.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\orqur - fortnite.exe" MD5
    3⤵
    PID:400
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4864
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4292

memory/5112-0-0x0000000140125000-0x000000014051A000-memory.dmp

Filesize
4.0MB

Download
memory/5112-3-0x0000000140000000-0x0000000140BAB000-memory.dmp

Filesize
11.7MB

Download
memory/5112-7-0x0000000140000000-0x0000000140BAB000-memory.dmp

Filesize
11.7MB

Download
memory/5112-2-0x00007FFA19CA0000-0x00007FFA19CA2000-memory.dmp

Filesize
8KB

Download
memory/5112-1-0x00007FFA19C90000-0x00007FFA19C92000-memory.dmp

Filesize
8KB

Download
memory/5112-8-0x0000000140000000-0x0000000140BAB000-memory.dmp

Filesize
11.7MB

Download
memory/5112-14-0x0000000140125000-0x000000014051A000-memory.dmp

Filesize
4.0MB

Download
memory/5112-15-0x0000000140000000-0x0000000140BAB000-memory.dmp

Filesize
11.7MB

Download