Overview
overview
7Static
static
7Geometry D...sh.exe
windows7-x64
3Geometry D...ep.ps1
windows7-x64
1Geometry D...64.exe
windows7-x64
7Geometry D...86.exe
windows7-x64
7Geometry D...64.exe
windows7-x64
7Geometry D...86.exe
windows7-x64
7Geometry D...od.dll
windows7-x64
Geometry D...32.dll
windows7-x64
3Geometry D...nv.dll
windows7-x64
3Geometry D...ns.dll
windows7-x64
3Geometry D...2d.dll
windows7-x64
3Geometry D...rl.dll
windows7-x64
3Geometry D...ff.dll
windows7-x64
1Geometry D...00.dll
windows7-x64
3Geometry D...20.dll
windows7-x64
3Geometry D...00.dll
windows7-x64
3Geometry D...20.dll
windows7-x64
3Geometry D...E2.dll
windows7-x64
1Geometry D...et.dll
windows7-x64
1Geometry D...e3.dll
windows7-x64
3Geometry D...pi.dll
windows7-x64
1Geometry D...ts.dll
windows7-x64
3Geometry D...b1.dll
windows7-x64
3Analysis
-
max time kernel
117s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
24-11-2023 13:45
Static task
static1
Behavioral task
behavioral1
Sample
Geometry Dash/GeometryDash.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
Geometry Dash/Resources/xStep.ps1
Resource
win7-20231023-en
Behavioral task
behavioral3
Sample
Geometry Dash/_CommonRedist/vcredist/2010/vcredist_x64.exe
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
Geometry Dash/_CommonRedist/vcredist/2010/vcredist_x86.exe
Resource
win7-20231023-en
Behavioral task
behavioral5
Sample
Geometry Dash/_CommonRedist/vcredist/2013/vcredist_x64.exe
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
Geometry Dash/_CommonRedist/vcredist/2013/vcredist_x86.exe
Resource
win7-20231025-en
Behavioral task
behavioral7
Sample
Geometry Dash/fmod.dll
Resource
win7-20231023-en
Behavioral task
behavioral8
Sample
Geometry Dash/glew32.dll
Resource
win7-20231023-en
Behavioral task
behavioral9
Sample
Geometry Dash/iconv.dll
Resource
win7-20231020-en
Behavioral task
behavioral10
Sample
Geometry Dash/libExtensions.dll
Resource
win7-20231020-en
Behavioral task
behavioral11
Sample
Geometry Dash/libcocos2d.dll
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
Geometry Dash/libcurl.dll
Resource
win7-20231023-en
Behavioral task
behavioral13
Sample
Geometry Dash/libtiff.dll
Resource
win7-20231020-en
Behavioral task
behavioral14
Sample
Geometry Dash/msvcp100.dll
Resource
win7-20231025-en
Behavioral task
behavioral15
Sample
Geometry Dash/msvcp120.dll
Resource
win7-20231023-en
Behavioral task
behavioral16
Sample
Geometry Dash/msvcr100.dll
Resource
win7-20231020-en
Behavioral task
behavioral17
Sample
Geometry Dash/msvcr120.dll
Resource
win7-20231020-en
Behavioral task
behavioral18
Sample
Geometry Dash/pthreadVCE2.dll
Resource
win7-20231023-en
Behavioral task
behavioral19
Sample
Geometry Dash/sdkencryptedappticket.dll
Resource
win7-20231023-en
Behavioral task
behavioral20
Sample
Geometry Dash/sqlite3.dll
Resource
win7-20231025-en
Behavioral task
behavioral21
Sample
Geometry Dash/steam_api.dll
Resource
win7-20231020-en
Behavioral task
behavioral22
Sample
Geometry Dash/websockets.dll
Resource
win7-20231023-en
Behavioral task
behavioral23
Sample
Geometry Dash/zlib1.dll
Resource
win7-20231020-en
General
-
Target
Geometry Dash/msvcr120.dll
-
Size
948KB
-
MD5
034ccadc1c073e4216e9466b720f9849
-
SHA1
f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
-
SHA256
86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
-
SHA512
5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
-
SSDEEP
12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1460 2888 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 772 wrote to memory of 2888 772 rundll32.exe rundll32.exe PID 772 wrote to memory of 2888 772 rundll32.exe rundll32.exe PID 772 wrote to memory of 2888 772 rundll32.exe rundll32.exe PID 772 wrote to memory of 2888 772 rundll32.exe rundll32.exe PID 772 wrote to memory of 2888 772 rundll32.exe rundll32.exe PID 772 wrote to memory of 2888 772 rundll32.exe rundll32.exe PID 772 wrote to memory of 2888 772 rundll32.exe rundll32.exe PID 2888 wrote to memory of 1460 2888 rundll32.exe WerFault.exe PID 2888 wrote to memory of 1460 2888 rundll32.exe WerFault.exe PID 2888 wrote to memory of 1460 2888 rundll32.exe WerFault.exe PID 2888 wrote to memory of 1460 2888 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\msvcr120.dll",#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\msvcr120.dll",#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 2243⤵
- Program crash