0a1ae2bb65566514f671912024cd0e5a9f7ca6c886933f04faf2667d8ef40878

Analysis

max time kernel
119s
max time network
133s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
19/09/2023, 18:38

Target

Geometry Dash/quickldr.dll
Size

108KB
MD5

3e9c214662a51ca691034d77160a32e1
SHA1

ee0189755e8f1e5b10daad554e5539d018ce9b0a
SHA256

239ebc6933e69d652a3b3e89d6188fc15908833f54c52180012ab60aac8b228b
SHA512

89d832f248527701885cbd86731bb630a0eeca3762392fd26ca5735d9449e0e80530e75462cb602207178839545b807624ad126dff5c23b3667e472b08555710
SSDEEP

768:eNfySV1AiXCdcAfi3ndDrUSsBannv08NQkUQlBGIx34ghz5PmFR/EXgVOAyyPqm0:eN5V6iWlcFOGzNQQlMIx34ghFPAPt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 2692	1880	rundll32.exe	69
PID 1880 wrote to memory of 2692	1880	rundll32.exe	69
PID 1880 wrote to memory of 2692	1880	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\quickldr.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\quickldr.dll",#1
  2⤵
  PID:2692