2f2cbdd0bcac3cfd7618b516ea7f8c7d5dbb82f431c0505ff29ec8845f88b285

Analysis

max time kernel
118s
max time network
139s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 14:08

Target

Geometry Dash 2.113/Geometry Dash/websockets.dll
Size

75KB
MD5

e1db6e022098c0caec94c22cb81def3c
SHA1

ddfe57fe157446348706644b6908602bb02e401d
SHA256

528624dda7a00149c976268e1350cb884d825ed02afe52415299f55c65b7d346
SHA512

21dbcc0082eb1119804efe3162089ccdbce7a60ea6082046a08a8acc6a32e29030a3314ba35625d6ad7d20f6e79bf033b7271e3865731842714fa6dac6d0bce9
SSDEEP

1536:T8lzDqHQ7ZwUOfYZtZU5CYgEqRF09TQCIOBnToIfRAQhDx:T8lgqZwsPfKTQgpTBfRAQh

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2900 2416 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2900	2416	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2124 wrote to memory of 2416	2124	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 2416	2124	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 2416	2124	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 2416	2124	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 2416	2124	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 2416	2124	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 2416	2124	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2900	2416	rundll32.exe	WerFault.exe
PID 2416 wrote to memory of 2900	2416	rundll32.exe	WerFault.exe
PID 2416 wrote to memory of 2900	2416	rundll32.exe	WerFault.exe
PID 2416 wrote to memory of 2900	2416	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.113\Geometry Dash\websockets.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.113\Geometry Dash\websockets.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 224
3⤵
- Program crash
PID:2900