ca365cb41707416bdbb3410a3e17e22da5adf132d3384fe79e3c7eb9cacc4b04

Resubmissions

04-02-2024 07:10

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 07:10

Target

Fortnite_v2.7.exe
Size

20.6MB
MD5

bea5534a5c5471994f5972e7c9d27e58
SHA1

c4ee984674d86208b9d67dee4e95c8105969931a
SHA256

ca365cb41707416bdbb3410a3e17e22da5adf132d3384fe79e3c7eb9cacc4b04
SHA512

8a3022b86f386ca443665bf66aac855893576b78badaf8cae2dc1813b68b869ab1ddef1621066613b96ec0874d0ca49d09ad47a3646693858bfe1b7fa4915bfe
SSDEEP

393216:pqPnLFXlrlSeqzbQpDOETgsvfGa3KghRkyK8vE4fdvkiOEm:gPLFXNhabQoEG6eHVy6

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2440	Fortnite_v2.7.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019bfa-128.dat	upx
behavioral1/files/0x0005000000019bfa-129.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2440	2240	Fortnite_v2.7.exe	28
PID 2240 wrote to memory of 2440	2240	Fortnite_v2.7.exe	28
PID 2240 wrote to memory of 2440	2240	Fortnite_v2.7.exe	28

C:\Users\Admin\AppData\Local\Temp\Fortnite_v2.7.exe
"C:\Users\Admin\AppData\Local\Temp\Fortnite_v2.7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\Fortnite_v2.7.exe
  "C:\Users\Admin\AppData\Local\Temp\Fortnite_v2.7.exe"
  2⤵
  - Loads dropped DLL
  PID:2440

C:\Users\Admin\AppData\Local\Temp\_MEI22402\python310.dll

Filesize
1.4MB

MD5
69d4f13fbaeee9b551c2d9a4a94d4458

SHA1
69540d8dfc0ee299a7ff6585018c7db0662aa629

SHA256
801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046

SHA512
8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22402\setuptools-65.5.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI22402\python310.dll

Filesize
1.1MB

MD5
1dcacce3b3f4fb6859d415532427cb1b

SHA1
98dadc7fca1ceb80d1cc81a125fe2a0aa943348a

SHA256
4bd06aa9d5797d6418ee0519eabc45086325dd6312ba2b613a8012236c8dc68d

SHA512
92937d72e04c978e7572ac086d23854acc6d63acb562ea147f57c990480352147bbf628ca1a5ddbfc96735e265222e9c0122c58fc6c4ce9c72c8b65866a5c39c

Download Submit
memory/2440-130-0x000007FEF5AB0000-0x000007FEF5F1E000-memory.dmp

Filesize
4.4MB

Download