094f1679afec5ba28beb2ff79e210f62a9b6583a3a443e040edff0cd02583487

Analysis

max time kernel
160s
max time network
488s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 07:53

Target

Geometry Dash/GDMenu/tools/libintl3.dll
Size

101KB
MD5

d202baa425176287017ffe1fb5d1b77c
SHA1

192e597d8ff0192f6c4e4643361f84277ed51121
SHA256

f48ce1866602b114e653c876334b771107559acf1c685373d2305034613958f0
SHA512

706d74c56ce8d08539c729bdb6c8d57c9a4b0a1c795b8574a1bb2c452358e1bfd5d4fca5a00ab7568dea4ae02c553ce6ab199b3c6418a44cb8915f7e26bd2988
SSDEEP

1536:bMuK+nitJ6B/16WVlvdftjm0YMBBCauBKNJ0n/bDsS22E:bMuMJ6B/16Srf9ljJ0/boS22E

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3536 4608 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3536	4608	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4312 wrote to memory of 4608	4312	rundll32.exe	rundll32.exe
PID 4312 wrote to memory of 4608	4312	rundll32.exe	rundll32.exe
PID 4312 wrote to memory of 4608	4312	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\GDMenu\tools\libintl3.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4312

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\GDMenu\tools\libintl3.dll",#1
2⤵
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 628
3⤵
- Program crash
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4608 -ip 4608
1⤵
PID:4828

memory/4608-0-0x0000000060E40000-0x0000000060E5D000-memory.dmp

Filesize
116KB

Download
memory/4608-1-0x0000000067200000-0x00000000672FB000-memory.dmp

Filesize
1004KB

Download