aa34757404acb227cc93a8c88f31fbf4c803243c495badbd4a18429f2da71c45

Analysis

max time kernel
93s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08/11/2022, 05:09

Target
Fortnite Checker By CrackFreakQ/d3dcompiler_47.dll
Size 3.5MB
Sample221108-ftm85shfa4
SHA256 381ec497d7d40b83616b0e82e15c597d04433acc20e94ebe5611f954b2e5309b
MD5 d808acb53436ca8bf04f88d3b40200cb
SHA1 493344c681a2269bb8c202f020ae0583814d2816
SHA512 86dc1ce2ae6c7a36b2f7d4a18278cec99a9a8743df657b2546ef46f0e8007c94d55354fe765a9c17a2fd5b15f21693691d177407b141be23bcde24635093efb5
SSDEEP 49152:1VBD1/zMxpjAeHhtiv2dGDwhMeX1/iK6AoVCdUTFE:17ZMxpjAeHhtivBDwh1c51
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4968	1496	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 1496	3996	rundll32.exe	80
PID 3996 wrote to memory of 1496	3996	rundll32.exe	80
PID 3996 wrote to memory of 1496	3996	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Fortnite Checker By CrackFreakQ\d3dcompiler_47.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Fortnite Checker By CrackFreakQ\d3dcompiler_47.dll",#1
  2⤵
  PID:1496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 612
    3⤵
    - Program crash
    PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1496 -ip 1496
1⤵
PID:4620