30956e0fd53f8ca9cd852201dd649585ec9cecd8c34b9478f97529a1bfe3a1d6 | Triage

Analysis

max time kernel
122s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:20

Sharing

Report Analysis Logs

General

Target

BattlEye/BEServer_x86.dll
Size

84KB
MD5

4cb2365b6fd952909e02db9580b5980d
SHA1

d083fd4e1c7e22cefd744db75d99a8b8fd0416b7
SHA256

368234ec290a9b587469427508bea1a16ee1cf26bd2c049c896102cb50f7cc4e
SHA512

aa992b3013d95a645a393a0a85ab7c9a55a334834eefc67056896352c2f2846289a250a217db38b22541bcc9b30b0cde476a62a46d6c90092162495503d65e90
SSDEEP

1536:foQ67+m5kZXCzlT/Cw1XAd4JnLCz8pW5vkntXW:AQS+m5kZmZ/W5qt

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1340	4072	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 4072	2480	rundll32.exe	89
PID 2480 wrote to memory of 4072	2480	rundll32.exe	89
PID 2480 wrote to memory of 4072	2480	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BattlEye\BEServer_x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\BattlEye\BEServer_x86.dll,#1
  2⤵
  PID:4072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 636
    3⤵
    - Program crash
    PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4072 -ip 4072
1⤵
PID:4692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads