Analysis

  • max time kernel
    126s
  • max time network
    137s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27-07-2024 00:21

General

  • Target

    Battlefield 2/NavMesh/charset.dll

  • Size

    24KB

  • MD5

    fe93f115d845a4c9f72e1f7d8068950d

  • SHA1

    51c7b55cdc195994fa9d62baee1bf7a11a35bc74

  • SHA256

    3b1ae5b01630242de5f287af1f34ac740dcf057faad9eef723a2efdfef4d62f5

  • SHA512

    6b90a45a271d5a104556f0fe9ab5652e418a1ed2ca1d15e1948c10ff5c822cfd15ec6278e1aaebf6742a77a52f835bfe971eb994fa658339b6c4c08b557e0c7d

  • SSDEEP

    48:SyCUEgrgQXnf8tQfqYg8yWp1U+SLkOKjTdIOmhKOOmhCNowf9l6EvowZriKrexrk:Hr8YqYnTaLMT2ZhKOZhkreCJ

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Battlefield 2\NavMesh\charset.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4364
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Battlefield 2\NavMesh\charset.dll",#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3012

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads