Analysis

  • max time kernel
    101s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/08/2023, 01:43

General

  • Target

    Geometry Dash/Resources/LevelDataMeltdown.xml

  • Size

    271KB

  • MD5

    b81c34cc8166bcaf4deb13813100b899

  • SHA1

    dd46b883fa73d64bb98b886f92f09dc2e3d97385

  • SHA256

    070018d75cd0841a17d034d1d4cd5784776c89abcaf21ae362879c7421d3bcc4

  • SHA512

    35bbcd11e55aeb33ea3169c26744262878987b20c0b61689fead2a8bf344694201859d61b9abd6691859bc46dcb939cf35d8753078e77c54820658a1840ebd6d

  • SSDEEP

    6144:83Zx7cVbgRroMJI6pU9iQ0YdElzx0Wh956pJO18OBU02Q:877cqVe6zzlzaWh9yJOKT02Q

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\Resources\LevelDataMeltdown.xml"
    1⤵
      PID:4784
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 4784 -s 448
        2⤵
        • Program crash
        PID:456
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 404 -p 4784 -ip 4784
      1⤵
        PID:2484

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4784-134-0x00007FFA59930000-0x00007FFA59B25000-memory.dmp

        Filesize

        2.0MB

      • memory/4784-133-0x00007FFA199B0000-0x00007FFA199C0000-memory.dmp

        Filesize

        64KB

      • memory/4784-135-0x00007FFA59930000-0x00007FFA59B25000-memory.dmp

        Filesize

        2.0MB

      • memory/4784-136-0x00007FFA576B0000-0x00007FFA57979000-memory.dmp

        Filesize

        2.8MB

      • memory/4784-137-0x00007FFA199B0000-0x00007FFA199C0000-memory.dmp

        Filesize

        64KB

      • memory/4784-138-0x00007FFA59930000-0x00007FFA59B25000-memory.dmp

        Filesize

        2.0MB