2f2cbdd0bcac3cfd7618b516ea7f8c7d5dbb82f431c0505ff29ec8845f88b285

Analysis

max time kernel
33s
max time network
41s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 17:42

Target

Geometry Dash 2.113/Geometry Dash/libcocos2d.dll
Size

1.7MB
MD5

29cfb52b30b2f487e30da873a4f20abf
SHA1

385b53196dc5e2a1a009bde23551faf9ba1d380e
SHA256

c17c4eddf891c3c1f2e24129e9d9dc49a027c5c7827f77e20cc8fd311be327a1
SHA512

fd520051c48995e527fb57799f2e7f58d4a0b26eae820afe41e7e1c9dbe35b41772cd870ac92feb640ac23270ef46b789c157733c97d3bf8af04c1ad5dc09824
SSDEEP

24576:cVtR9yxzz3nJYZl4ZbtMCeGg7dP6BXt/NKl9vl6Wm8y0vrJTQYOVPKRqicw0:cVtkFX2SgMdN69vlhyOJTQYOVPecw0

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1864 2820 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1864	2820	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2620 wrote to memory of 2820	2620	rundll32.exe	rundll32.exe
PID 2620 wrote to memory of 2820	2620	rundll32.exe	rundll32.exe
PID 2620 wrote to memory of 2820	2620	rundll32.exe	rundll32.exe
PID 2620 wrote to memory of 2820	2620	rundll32.exe	rundll32.exe
PID 2620 wrote to memory of 2820	2620	rundll32.exe	rundll32.exe
PID 2620 wrote to memory of 2820	2620	rundll32.exe	rundll32.exe
PID 2620 wrote to memory of 2820	2620	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 1864	2820	rundll32.exe	WerFault.exe
PID 2820 wrote to memory of 1864	2820	rundll32.exe	WerFault.exe
PID 2820 wrote to memory of 1864	2820	rundll32.exe	WerFault.exe
PID 2820 wrote to memory of 1864	2820	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.113\Geometry Dash\libcocos2d.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2620

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.113\Geometry Dash\libcocos2d.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 260
3⤵
- Program crash
PID:1864