6834e4f3defe1566f5c9fe9b25e8ae29144fcdf16115e14204e29d6ff4efe111 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 19:15

Sharing

Report Analysis Logs

General

Target

FortniteCracker/FortniteCracker.exe
Size

14.3MB
MD5

41ca32a6b1ea0ebf1be53c85632d4af1
SHA1

99bf3882e3ad022ba3cdc43ac033382d941c4eaa
SHA256

f98fb5b78dde808aac86a43a6ce0889f10f8ea6e92657d9774d540ef50f7863c
SHA512

e6e945351bb02c720b5c4e1087382023e09f742cae74879a17ed043cfd71fd41bab9b65069c3d39e21b94fc8a86a941e69c96ecd8242a62971d9b9f31b445a76
SSDEEP

393216:QiIE7YoPQMidQuslSq99oWOv+9fg4TFprTACw:R7rPQ3dQuSDorvSY4TF1AD

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2112	FortniteCracker.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2112	2900	FortniteCracker.exe	28
PID 2900 wrote to memory of 2112	2900	FortniteCracker.exe	28
PID 2900 wrote to memory of 2112	2900	FortniteCracker.exe	28

C:\Users\Admin\AppData\Local\Temp\FortniteCracker\FortniteCracker.exe
"C:\Users\Admin\AppData\Local\Temp\FortniteCracker\FortniteCracker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\FortniteCracker\FortniteCracker.exe
  "C:\Users\Admin\AppData\Local\Temp\FortniteCracker\FortniteCracker.exe"
  2⤵
  - Loads dropped DLL
  PID:2112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI29002\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit