2f2cbdd0bcac3cfd7618b516ea7f8c7d5dbb82f431c0505ff29ec8845f88b285

Analysis

max time kernel
105s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 17:42

Target

Geometry Dash 2.113/Geometry Dash/steam_api.dll
Size

854KB
MD5

226d0e9d0383c34ae5021e70b3b029c9
SHA1

e45defcc669479c365c9c2b1e888860cf57286a6
SHA256

1cb212268170094dbb12147fa55a9c9688dd123046812e7f0182e072762ea400
SHA512

fbbb54f34670a6924fe07b28086067d487fcfd4d912c9afb27a19247121e04848d727b5f7b7eaaedaa31cf1788f48b9acb7cbd2cb656836b8e17b9b2e7a46e38
SSDEEP

24576:xWz6Mh4mCone+iIqSDgU0o7LoiqJYCuyUCP0:66MhCdIqSqOSJ7gCP

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral26/memory/1148-0-0x0000000074140000-0x0000000074E4A000-memory.dmp	upx
behavioral26/memory/1148-1-0x0000000074140000-0x0000000074E4A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2692 wrote to memory of 1148	2692	rundll32.exe	rundll32.exe
PID 2692 wrote to memory of 1148	2692	rundll32.exe	rundll32.exe
PID 2692 wrote to memory of 1148	2692	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.113\Geometry Dash\steam_api.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.113\Geometry Dash\steam_api.dll",#1
2⤵
PID:1148

memory/1148-0-0x0000000074140000-0x0000000074E4A000-memory.dmp

Filesize
13.0MB

Download
memory/1148-1-0x0000000074140000-0x0000000074E4A000-memory.dmp

Filesize
13.0MB

Download