2f2cbdd0bcac3cfd7618b516ea7f8c7d5dbb82f431c0505ff29ec8845f88b285

Analysis

max time kernel
120s
max time network
139s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 14:08

Target

Geometry Dash 2.113/Geometry Dash/GeometryDash.exe
Size

6.5MB
MD5

46ec62179269cb42610e1765e42bee56
SHA1

5e8817dea570975266a8a73cdd0337b04bdcf44f
SHA256

83fd16958d612a4e775183030a88184dd96ebc5c0eafa5e0874d77e9b0087d84
SHA512

737b83a6307ba146bd220f3781df792a6d8cc79dc4eeed4335b193a3ab4dc85afffebbd340b93269b2506e3f514150569a005980133413af5926d379cc58501d
SSDEEP

49152:Bug8dPHi2XXq8dWTHIuKO77ii+4fVoVNG+w6xfS+w6xfSExfSRaTQAYjzDTjE:QDnq8WLKO7ekGVNVVxfS+VxfSgfSR

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2296-0-0x0000000072D30000-0x0000000073A3A000-memory.dmp	upx
behavioral1/memory/2296-1-0x0000000072D30000-0x0000000073A3A000-memory.dmp	upx
behavioral1/memory/2296-6-0x0000000072D30000-0x0000000073A3A000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2700 2296 WerFault.exe GeometryDash.exe

pid	pid_target	process	target process
2700	2296	WerFault.exe	GeometryDash.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

GeometryDash.exe

description	pid	process	target process
PID 2296 wrote to memory of 2700	2296	GeometryDash.exe	WerFault.exe
PID 2296 wrote to memory of 2700	2296	GeometryDash.exe	WerFault.exe
PID 2296 wrote to memory of 2700	2296	GeometryDash.exe	WerFault.exe
PID 2296 wrote to memory of 2700	2296	GeometryDash.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.113\Geometry Dash\GeometryDash.exe
"C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.113\Geometry Dash\GeometryDash.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 332
2⤵
- Program crash
PID:2700

memory/2296-0-0x0000000072D30000-0x0000000073A3A000-memory.dmp

Filesize
13.0MB

Download
memory/2296-1-0x0000000072D30000-0x0000000073A3A000-memory.dmp

Filesize
13.0MB

Download
memory/2296-6-0x0000000072D30000-0x0000000073A3A000-memory.dmp

Filesize
13.0MB

Download