Resubmissions

01/08/2023, 17:20

230801-vwvtbsab49 7

Analysis

  • max time kernel
    138s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/08/2023, 17:20

General

  • Target

    Geometry Dash/Resources/LoadData.xml

  • Size

    40KB

  • MD5

    8bcf15023c1808f5de87ede95b339989

  • SHA1

    6c76fd2310e6837d41b685e424af4dfc83457f72

  • SHA256

    2ce332090435b4145929c12acda2e32373e88bad3c87b978a6ab07dff737da61

  • SHA512

    a7224fb333a1d2895fd30fc4decac728e2bee3dcda4af8b45c2440efd647e048c964ae6e8dc73bdbf7ea7416add94611d4c063972737c3f36675848ab9b13849

  • SSDEEP

    768:MY1cGm9YRslsj6a/yUPp2flDcRXBZLbxZyvN2sF4hsZ/8SyJvcO3Sr1m6AXS:T1cBYNGaQtARXvvxZyvNFDZAvd3S12S

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\Resources\LoadData.xml"
    1⤵
      PID:2772
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2772 -s 448
        2⤵
        • Program crash
        PID:4108
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 376 -p 2772 -ip 2772
      1⤵
        PID:4104

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2772-133-0x00007FFADD3D0000-0x00007FFADD3E0000-memory.dmp

        Filesize

        64KB

      • memory/2772-134-0x00007FFB1D350000-0x00007FFB1D545000-memory.dmp

        Filesize

        2.0MB

      • memory/2772-135-0x00007FFB1D350000-0x00007FFB1D545000-memory.dmp

        Filesize

        2.0MB

      • memory/2772-136-0x00007FFB1AFC0000-0x00007FFB1B289000-memory.dmp

        Filesize

        2.8MB

      • memory/2772-137-0x00007FFADD3D0000-0x00007FFADD3E0000-memory.dmp

        Filesize

        64KB

      • memory/2772-138-0x00007FFB1D350000-0x00007FFB1D545000-memory.dmp

        Filesize

        2.0MB