0a1ae2bb65566514f671912024cd0e5a9f7ca6c886933f04faf2667d8ef40878

Analysis

max time kernel
136s
max time network
145s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
19/09/2023, 18:38

Target

Geometry Dash/quickldr/betterinfo-wrapper.dll
Size

454KB
MD5

f7894cfef5841f4187bc7e9e85ac519f
SHA1

639f83342d414ada4ed98d490d79d7db80183031
SHA256

32c00ec5e2f9b20ba9126e7de3ed49b0a54660176adee8e493ecdd6b08f42ddd
SHA512

c5ed13d4f01282ef310b11019db8710b80525a2a1ff026956221d97a5bff6111953145b1a84d10f6d44e339313ab6c1567491ee5908568debe17ee095f785b19
SSDEEP

12288:f5Nz6eEOQeG4L0zTtlLhoRehjivmKpCoWDGE8KvTPMqq3W1UNG:RB6neG0WGE8KvTPMq/uNG

Score

8^/10

Blocklisted process makes network request 28 IoCs

Loads dropped DLL 2 IoCs

pid	Process
4320	rundll32.exe
4320	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 4320	3524	rundll32.exe	69
PID 3524 wrote to memory of 4320	3524	rundll32.exe	69
PID 3524 wrote to memory of 4320	3524	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\quickldr\betterinfo-wrapper.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\quickldr\betterinfo-wrapper.dll",#1
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:4320

\Users\Admin\AppData\Local\Temp\Geometry Dash\quickldr\betterinfo\v2\betterinfo.dll

Filesize
531KB

MD5
5881497cfe50f075bfa86344febf4028

SHA1
8dd1ea3a4b194ad4bbc963b7e4d668816aaa6c5e

SHA256
94171d8ab49f8ef517eb28c851ce94738f9e5b17112082088b0591f29f62bcb6

SHA512
ce950afd9c6009c4c220138b08348ce261ee0f26bc46c1d5c195a1b828d8436ad2e36f0913774b190658504e9eab39fa7ddf79b52bc5e975bf4b3b8279aa1652

Download Submit
\Users\Admin\AppData\Local\Temp\Geometry Dash\quickldr\minhook.x32.dll

Filesize
18KB

MD5
71d921951eb008c82cc6b98ce71f2c67

SHA1
91fa98d3496e5474123c94a0980a03c53dc567e8

SHA256
80b6a91f55324f5907a9f4305ff46eef36197008fd4dd954ef9388c1d3307ff7

SHA512
d8e294f90bb7178b69c03cfb817aeb65cec08e7fbfabbe6dd5e739e6fce94add8b37c5d3d98a109b597fc01e917d1e12b1f19df2f19fbd65b63e867be5620843

Download Submit