2f2cbdd0bcac3cfd7618b516ea7f8c7d5dbb82f431c0505ff29ec8845f88b285 | Triage

Analysis

max time kernel
140s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 14:08

Sharing

Report Analysis Logs

General

Target

Geometry Dash 2.113/Geometry Dash/sqlite3.dll
Size

527KB
MD5

0ec32327447976d439358bc1db47cd31
SHA1

516e8df1b4cf92475b07131637b1f93cca27f077
SHA256

34057639b01413314a1b67c56c5d81e2aaa965f4eef1b9e11f2aa2261a628a0b
SHA512

448a81db8aebfd1907b039b14327948ae675683c704a86d8a9f38e2a2a91dcde7c99b6be04d97877bbc8d9405392b96e4e580d90a910243d9904943334a3ff6f
SSDEEP

12288:ZKyZVQn8QoxwgBFn32Q7bomYRJMdwm5HE8V:ZzcQHb2o4fB

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4388 5024 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2588 wrote to memory of 5024	2588	rundll32.exe	rundll32.exe
PID 2588 wrote to memory of 5024	2588	rundll32.exe	rundll32.exe
PID 2588 wrote to memory of 5024	2588	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.113\Geometry Dash\sqlite3.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2588

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.113\Geometry Dash\sqlite3.dll",#1
2⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 604
3⤵
- Program crash
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5024 -ip 5024
1⤵
PID:3392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads