2f2cbdd0bcac3cfd7618b516ea7f8c7d5dbb82f431c0505ff29ec8845f88b285

Analysis

max time kernel
117s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 14:08

Target

Geometry Dash 2.113/Geometry Dash/websockets.dll
Size

75KB
MD5

e1db6e022098c0caec94c22cb81def3c
SHA1

ddfe57fe157446348706644b6908602bb02e401d
SHA256

528624dda7a00149c976268e1350cb884d825ed02afe52415299f55c65b7d346
SHA512

21dbcc0082eb1119804efe3162089ccdbce7a60ea6082046a08a8acc6a32e29030a3314ba35625d6ad7d20f6e79bf033b7271e3865731842714fa6dac6d0bce9
SSDEEP

1536:T8lzDqHQ7ZwUOfYZtZU5CYgEqRF09TQCIOBnToIfRAQhDx:T8lgqZwsPfKTQgpTBfRAQh

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3536 3664 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3536	3664	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4056 wrote to memory of 3664	4056	rundll32.exe	rundll32.exe
PID 4056 wrote to memory of 3664	4056	rundll32.exe	rundll32.exe
PID 4056 wrote to memory of 3664	4056	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.113\Geometry Dash\websockets.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4056

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.113\Geometry Dash\websockets.dll",#1
2⤵
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 620
3⤵
- Program crash
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3664 -ip 3664
1⤵
PID:1228