966fa74e8f619340ed40699bb939555e0fce3ab16c750b54e8beb3bc782b8c04

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 12:41

Target

Epic.Games.Account.Generator.Helper.exe
Size

6.1MB
MD5

576406e1149246fb9e286a9ee050afb1
SHA1

f8fb395bb4feeb4d6cd0b36ef6cface0f2944d95
SHA256

966fa74e8f619340ed40699bb939555e0fce3ab16c750b54e8beb3bc782b8c04
SHA512

2cc2cf9cca084a9d724c91c24f270d1dde4af4c6705e885ae3e70a1c85d9b5b5f23e259bda5e438d95ef67b2860d577580f41c544e761a11925e23f8ae2eecde
SSDEEP

98304:HB8EQezhQxzeb+sX1ZvbeAyJZ34Z0FGRABTgtse6vzovkFSZZRg6z9KxzKYcm:HBRhQxiCsXDjDyf3ZkJMFEZ2xxzKW

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2672	Epic.Games.Account.Generator.Helper.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2672	2656	Epic.Games.Account.Generator.Helper.exe	29
PID 2656 wrote to memory of 2672	2656	Epic.Games.Account.Generator.Helper.exe	29
PID 2656 wrote to memory of 2672	2656	Epic.Games.Account.Generator.Helper.exe	29

C:\Users\Admin\AppData\Local\Temp\Epic.Games.Account.Generator.Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Epic.Games.Account.Generator.Helper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\Epic.Games.Account.Generator.Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\Epic.Games.Account.Generator.Helper.exe"
  2⤵
  - Loads dropped DLL
  PID:2672

C:\Users\Admin\AppData\Local\Temp\_MEI26562\python39.dll

Filesize
4.3MB

MD5
5cd203d356a77646856341a0c9135fc6

SHA1
a1f4ac5cc2f5ecb075b3d0129e620784814a48f7

SHA256
a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a

SHA512
390008d57fa711d7c88b77937bf16fdb230e7c1e7182faea6d7c206e9f65ced6f2e835f9da9befb941e80624abe45875602e0e7ad485d9a009d2450a2a0e0f1f

Download Submit