2f2cbdd0bcac3cfd7618b516ea7f8c7d5dbb82f431c0505ff29ec8845f88b285

Analysis

max time kernel
121s
max time network
137s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 14:08

Target

Geometry Dash 2.113/Geometry Dash/zlib1.dll
Size

76KB
MD5

72e87ad407bb28f5b471c3396296b377
SHA1

15cd01170ff8d8531fb16f4f7a1c5fbe810a1057
SHA256

91ec6085e862e1eedc254bf88efecd4fa67f486216ab3b1473915d15462e71bb
SHA512

1569939514c0e30e2fbf7d81586ada53931ac36b11f306b95b5e0741c6b32c45d88d33271223c99cd4fbd585f0675d5188557e5dfe6901f9fbb2e3e8ec98a698
SSDEEP

768:bw6vENCUvhLcSCE/StC0KuFLRO5ZikoHBc1m7s4wixE+XwVY/nToIf18IOsIOIiy:bDvENBhA+WjPLAVY/nToIfCIOsIOIip

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2360 1076 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2360	1076	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2260 wrote to memory of 1076	2260	rundll32.exe	rundll32.exe
PID 2260 wrote to memory of 1076	2260	rundll32.exe	rundll32.exe
PID 2260 wrote to memory of 1076	2260	rundll32.exe	rundll32.exe
PID 2260 wrote to memory of 1076	2260	rundll32.exe	rundll32.exe
PID 2260 wrote to memory of 1076	2260	rundll32.exe	rundll32.exe
PID 2260 wrote to memory of 1076	2260	rundll32.exe	rundll32.exe
PID 2260 wrote to memory of 1076	2260	rundll32.exe	rundll32.exe
PID 1076 wrote to memory of 2360	1076	rundll32.exe	WerFault.exe
PID 1076 wrote to memory of 2360	1076	rundll32.exe	WerFault.exe
PID 1076 wrote to memory of 2360	1076	rundll32.exe	WerFault.exe
PID 1076 wrote to memory of 2360	1076	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.113\Geometry Dash\zlib1.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2260

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.113\Geometry Dash\zlib1.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 228
3⤵
- Program crash
PID:2360