4c08a8f3c94eb025877f8cb8ae3018578183d5b5e829280fee70fb700f04e428 | Triage

Analysis

max time kernel
25s
max time network
43s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
30-07-2022 16:35

Sharing

Report Analysis Logs

General

Target

Fortnite Hack v1.17/oo2core_8_win64.dll
Size

938KB
MD5

3169b48a9a2086e53c4493c03579902c
SHA1

5f3b2405818c29689875810164e7cd4da3f024c9
SHA256

e63ede4ebd7e64493ead8e91f475238ff7dec17eb403798e4ba27d592a9757a8
SHA512

a592ba68e008108f66c683f5d2edb29cf4ba15661151d54150089cd8ccf4d5ef265c62278a62a70a488db38a03ea4feacc9fa59173ee8220d864142ccf7dded0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1008 2040 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2040 wrote to memory of 1008	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 1008	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 1008	2040	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Fortnite Hack v1.17\oo2core_8_win64.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2040 -s 84
2⤵
- Program crash
PID:1008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1008-54-0x0000000000000000-mapping.dmp

Download