aa34757404acb227cc93a8c88f31fbf4c803243c495badbd4a18429f2da71c45

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08/11/2022, 05:09

Target
Fortnite Checker By CrackFreakQ/d3dcompiler_47.dll
Size 3.5MB
Sample221108-ftm85shfa4
SHA256 381ec497d7d40b83616b0e82e15c597d04433acc20e94ebe5611f954b2e5309b
MD5 d808acb53436ca8bf04f88d3b40200cb
SHA1 493344c681a2269bb8c202f020ae0583814d2816
SHA512 86dc1ce2ae6c7a36b2f7d4a18278cec99a9a8743df657b2546ef46f0e8007c94d55354fe765a9c17a2fd5b15f21693691d177407b141be23bcde24635093efb5
SSDEEP 49152:1VBD1/zMxpjAeHhtiv2dGDwhMeX1/iK6AoVCdUTFE:17ZMxpjAeHhtivBDwh1c51
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	1620	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 1620 wrote to memory of 1708	1620	rundll32.exe	27
PID 1620 wrote to memory of 1708	1620	rundll32.exe	27
PID 1620 wrote to memory of 1708	1620	rundll32.exe	27
PID 1620 wrote to memory of 1708	1620	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Fortnite Checker By CrackFreakQ\d3dcompiler_47.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Fortnite Checker By CrackFreakQ\d3dcompiler_47.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 224
    3⤵
    - Program crash
    PID:1708

memory/1620-55-0x0000000076681000-0x0000000076683000-memory.dmp

Download