00023ce602db623e47de1029595339eec4ee5019c6017236c9b721cac0ae4032

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/06/2026, 02:52

Target
4.bat
Size 107KB
Sample260602-dc5ezscs8x
SHA256 00023ce602db623e47de1029595339eec4ee5019c6017236c9b721cac0ae4032
MD5 98f1a0eebcb5f4798662a40323b05a7e
SHA1 068e288005c04b8d859c44d3767613a8036bdb11
SHA512 6cfda16ce56b1173b91bd86c0f977f022a0b01a77142a15f66d865ee3f00ffee6aa2df7571edcccac41f7d680a9c4c536991abd91e86a00b083b8f9f37a39cf7
SSDEEP 768:S/KZzmezF/svUsfg8gVhCBL1oPYdxCA1n5xpoL8oPlRPrPEPupL5LvLpLjLgwJyo:Kg8gUDRnvplQL5LvLpLjLnn
TLSH
T1ADB3D292621895B2D96704CC83EF964D3C7CE0C625F137A242F2BE48D94A83C567ADF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion

Kills process with taskkill 5 IoCs

defense_evasion

Suspicious use of AdjustPrivilegeToken 5 IoCs

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2652	1180	cmd.exe	87
PID 1180 wrote to memory of 4420	1180	cmd.exe	90
PID 1180 wrote to memory of 3488	1180	cmd.exe	91
PID 1180 wrote to memory of 2108	1180	cmd.exe	92
PID 1180 wrote to memory of 1240	1180	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2652
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4420
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3488
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2108
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1240