094f1679afec5ba28beb2ff79e210f62a9b6583a3a443e040edff0cd02583487

Analysis

max time kernel
222s
max time network
405s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 07:53

Target

Geometry Dash/GDMenu/tools/libeay32.dll
Size

1.1MB
MD5

6b854ffc12e5e2c32683a03714cf6c5d
SHA1

c8e5c0f57e18dfc5226ff0bd5bc63607e1754c66
SHA256

95550b81825ae3fb4298b0de1f7ebd116754d99483a6d73cc7271e002484a928
SHA512

92b8908875b3376d60b19bb0e812b678870c70d708a278c781bd7ad30fdc96464c2038d578152ab7c2e7394f089ba399a55b5d5d7b7179a321b1bd1ef28215bd
SSDEEP

24576:mIfI8mB7k7u58tRIqQaSp11OHpkfwnJOvsuzs9LwmaUbZs:mIgvyUYk1oO+9Lwm3Ns

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4380 wrote to memory of 1060	4380	rundll32.exe	rundll32.exe
PID 4380 wrote to memory of 1060	4380	rundll32.exe	rundll32.exe
PID 4380 wrote to memory of 1060	4380	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\GDMenu\tools\libeay32.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4380

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\GDMenu\tools\libeay32.dll",#1
2⤵
PID:1060

memory/1060-0-0x0000000063080000-0x00000000631A8000-memory.dmp

Filesize
1.2MB

Download