60c3cff394ce6c30e56054266f9e3634e8604524edf8a2ffb812c24125e9402d

Analysis

max time kernel
121s
max time network
137s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:26

Target

BattlEye/BEServer_x86.dll
Size

80KB
MD5

6cf57727949471a91bcb6c40751667f4
SHA1

0524ea24cd7bc9b1d5497b7d16a94657d947929a
SHA256

be1154c0d59e092b0be288188755ece8a2ed8009ec9099f6aba06c5304c46ece
SHA512

4820eaaa2f1dd184bf6c153b1fb41f077e62e9b05d81ad8aeb440847ce9698fdd2877f8ecc48c6c40d8fe51b74e0dd990616f95b4900100cb730c7cb347550e6
SSDEEP

1536:2sjm5MkxgC/KxnAXm7RepF3rjyKOwR4UtUlvwB1tkJ+Q:Xjm5MkxYtU4C4vgtkJ+Q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2724	2720	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2720	2400	rundll32.exe	29
PID 2400 wrote to memory of 2720	2400	rundll32.exe	29
PID 2400 wrote to memory of 2720	2400	rundll32.exe	29
PID 2400 wrote to memory of 2720	2400	rundll32.exe	29
PID 2400 wrote to memory of 2720	2400	rundll32.exe	29
PID 2400 wrote to memory of 2720	2400	rundll32.exe	29
PID 2400 wrote to memory of 2720	2400	rundll32.exe	29
PID 2720 wrote to memory of 2724	2720	rundll32.exe	30
PID 2720 wrote to memory of 2724	2720	rundll32.exe	30
PID 2720 wrote to memory of 2724	2720	rundll32.exe	30
PID 2720 wrote to memory of 2724	2720	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BattlEye\BEServer_x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\BattlEye\BEServer_x86.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 228
    3⤵
    - Program crash
    PID:2724