0a1ae2bb65566514f671912024cd0e5a9f7ca6c886933f04faf2667d8ef40878

Analysis

max time kernel
118s
max time network
136s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
19/09/2023, 18:38

Target

Geometry Dash/quickldr/BetterEdit-v4.0.5.dll
Size

1.7MB
MD5

5ba7cb42451ee99f647c520faf2696ee
SHA1

66c4a6e1018e25326ed25d0cf922f491217d2239
SHA256

013e90c7c560f9142791de878c57b78c31057dda226e7a3ee958a3e8ebb02735
SHA512

19a54be97b765f46e026c4380fcf9a450c23f14c9a508da397ee7a4a1d93ed51d0a4f92ece6d00e62f4d1aeb2a480229c8cba10a5701d0fce81e1df48cab6a67
SSDEEP

24576:+grp8usXcvqcaaBC1uJixnHk1D+oa+7+aVTvrA:+cp8ZdaBC1xHk1Dj17TTA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 4688	4192	rundll32.exe	71
PID 4192 wrote to memory of 4688	4192	rundll32.exe	71
PID 4192 wrote to memory of 4688	4192	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\quickldr\BetterEdit-v4.0.5.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\quickldr\BetterEdit-v4.0.5.dll",#1
  2⤵
  PID:4688