cc96f60f59c5be9e08c8ded6cc6b2b4c1296980dac5d08b8ea6edc837c072dfa

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23/03/2025, 03:24

Target

FortniteCheat_Premium.exe
Size

55.8MB
MD5

4f879c559dc7ebfc23a5539e3fa3b19f
SHA1

c8d5c521f2b5b12dac5b9851953e5167aeefe7d2
SHA256

cc96f60f59c5be9e08c8ded6cc6b2b4c1296980dac5d08b8ea6edc837c072dfa
SHA512

39550579e249fcaf0f1656660180fd7209d78afb8b43b27f3cdef1a46f63e08b94ce21d8c7d64fb9eca8a62168a2f83d61ef1140137b6621d257bb46cd681197
SSDEEP

1572864:ttIupuelOWcPyOkiqOv8im2AR+oXlmPwjlskCj8H:sYDsDKOknOv8i3K+oXUwCkC

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2848	FortniteCheat_Premium.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a75-1172.dat	upx
behavioral1/memory/2848-1174-0x000007FEF5D50000-0x000007FEF63B4000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2848	2212	FortniteCheat_Premium.exe	30
PID 2212 wrote to memory of 2848	2212	FortniteCheat_Premium.exe	30
PID 2212 wrote to memory of 2848	2212	FortniteCheat_Premium.exe	30

C:\Users\Admin\AppData\Local\Temp\FortniteCheat_Premium.exe
"C:\Users\Admin\AppData\Local\Temp\FortniteCheat_Premium.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\FortniteCheat_Premium.exe
  "C:\Users\Admin\AppData\Local\Temp\FortniteCheat_Premium.exe"
  2⤵
  - Loads dropped DLL
  PID:2848

C:\Users\Admin\AppData\Local\Temp\_MEI22122\python313.dll

Filesize
1.8MB

MD5
6b3a16dc31065257b7845d9ff611e3c6

SHA1
8cf971ee772193a93e49f4701f817bc6245cf81c

SHA256
3cdc6a436aa16671deb975af8290654a134bb916299677a08438fc7e91e6f7e6

SHA512
1d219471032c882b2e624ec1df951f6a59ee8ba39459d8eb917aaeec6899d0af6782580a5dc43ed1bbe852587c52bea32ba93ea195940335e2a19cc120c53aec

Download Submit
memory/2848-1174-0x000007FEF5D50000-0x000007FEF63B4000-memory.dmp

Filesize
6.4MB

Download