2f2cbdd0bcac3cfd7618b516ea7f8c7d5dbb82f431c0505ff29ec8845f88b285

Analysis

max time kernel
120s
max time network
152s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 14:08

Target

Geometry Dash 2.113/Geometry Dash/sdkencryptedappticket.dll
Size

558KB
MD5

e1b5265b323b0a92baaec24bfaedfcf7
SHA1

04e5b9dbc4697b215d7fdcdb742a5d208d175e53
SHA256

361001272651c6c262e5bc95c323adc398f4bbc4333c1a578a55d5c39a0e5302
SHA512

257fe355ed1ca0cdaa9583ce1760c660b32f3b17147142e1fa3a0ef5313958ff741043d2a3667f92d71160c09c51da8960f8a15475d6e0042790b584bbb61647
SSDEEP

12288:DZ6VT5dCFQvtWt2wxad6utBpKO9bdUWHbCzd2Nc1zwtnJI/0:16VFZtoO9GWHOxyc1zunm/0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2868 wrote to memory of 2308	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2308	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2308	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2308	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2308	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2308	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2308	2868	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.113\Geometry Dash\sdkencryptedappticket.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.113\Geometry Dash\sdkencryptedappticket.dll",#1
2⤵
PID:2308