60c3cff394ce6c30e56054266f9e3634e8604524edf8a2ffb812c24125e9402d

Analysis

max time kernel
164s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:26

Target

BattlEye/BEServer_x86.dll
Size

80KB
MD5

6cf57727949471a91bcb6c40751667f4
SHA1

0524ea24cd7bc9b1d5497b7d16a94657d947929a
SHA256

be1154c0d59e092b0be288188755ece8a2ed8009ec9099f6aba06c5304c46ece
SHA512

4820eaaa2f1dd184bf6c153b1fb41f077e62e9b05d81ad8aeb440847ce9698fdd2877f8ecc48c6c40d8fe51b74e0dd990616f95b4900100cb730c7cb347550e6
SSDEEP

1536:2sjm5MkxgC/KxnAXm7RepF3rjyKOwR4UtUlvwB1tkJ+Q:Xjm5MkxYtU4C4vgtkJ+Q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	936	WerFault.exe	87

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 936	3704	rundll32.exe	87
PID 3704 wrote to memory of 936	3704	rundll32.exe	87
PID 3704 wrote to memory of 936	3704	rundll32.exe	87
PID 936 wrote to memory of 3028	936	rundll32.exe	96
PID 936 wrote to memory of 3028	936	rundll32.exe	96
PID 936 wrote to memory of 3028	936	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BattlEye\BEServer_x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\BattlEye\BEServer_x86.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 612
    3⤵
    - Program crash
    PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 936 -ip 936
1⤵
PID:1948