0b835bacf6da0192a5d71090969e7747a0c20b6810d2df840845d67d3d899771

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
29-10-2024 13:59

Target

FortniteToolsV2.1.exe
Size

5.9MB
MD5

1011d55d70469b03f36c0f3927264fd7
SHA1

908556acac681ca109eef9bb00e4a9324557beb3
SHA256

0b835bacf6da0192a5d71090969e7747a0c20b6810d2df840845d67d3d899771
SHA512

95cfa4b83578b97b38a2fe73337a5cc7ca39455603df482d78a94da1cc4088f59fc35ca81aaee9d7a47dbf9ec43c4aabbe2b2588b20ac054cd173f19188166bd
SSDEEP

98304:2zfrAEHhCoP3i65sn6Wfz7pnxCb3AtZC0VZHtKpbzL8SG2XATHNm9bk6nnp/dCiU:2brAEDZDOYbwtZVZibPpG2QrNsb5neiU

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2784	FortniteToolsV2.1.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000195b3-22.dat	upx
behavioral1/memory/2784-24-0x000007FEF6B20000-0x000007FEF6F8E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2784	2412	FortniteToolsV2.1.exe	29
PID 2412 wrote to memory of 2784	2412	FortniteToolsV2.1.exe	29
PID 2412 wrote to memory of 2784	2412	FortniteToolsV2.1.exe	29

C:\Users\Admin\AppData\Local\Temp\FortniteToolsV2.1.exe
"C:\Users\Admin\AppData\Local\Temp\FortniteToolsV2.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\FortniteToolsV2.1.exe
  "C:\Users\Admin\AppData\Local\Temp\FortniteToolsV2.1.exe"
  2⤵
  - Loads dropped DLL
  PID:2784

C:\Users\Admin\AppData\Local\Temp\_MEI24122\python310.dll

Filesize
1.4MB

MD5
76cb307e13fbbfb9e466458300da9052

SHA1
577f0029ac8c2dd64d6602917b7a26bcc2b27d2b

SHA256
95066c06d9ed165f0b6f34079ed917df1111bd681991f96952d9ee35d37dc615

SHA512
f15b17215057433d88f1a8e05c723a480b4f8bc56d42185c67bb29a192f435f54345aa0f6d827bd291e53c46a950f2e01151c28b084b7478044bd44009eced8f

Download Submit
memory/2784-24-0x000007FEF6B20000-0x000007FEF6F8E000-memory.dmp

Filesize
4.4MB

Download