005f07797d5948b5d327bb60261fba73dba8ed19f5288dc570d8226ef97b463a

Analysis

max time kernel
121s
max time network
142s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24-11-2023 13:45

Target

Geometry Dash/sdkencryptedappticket.dll
Size

558KB
MD5

e1b5265b323b0a92baaec24bfaedfcf7
SHA1

04e5b9dbc4697b215d7fdcdb742a5d208d175e53
SHA256

361001272651c6c262e5bc95c323adc398f4bbc4333c1a578a55d5c39a0e5302
SHA512

257fe355ed1ca0cdaa9583ce1760c660b32f3b17147142e1fa3a0ef5313958ff741043d2a3667f92d71160c09c51da8960f8a15475d6e0042790b584bbb61647
SSDEEP

12288:DZ6VT5dCFQvtWt2wxad6utBpKO9bdUWHbCzd2Nc1zwtnJI/0:16VFZtoO9GWHOxyc1zunm/0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2004 wrote to memory of 1400	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1400	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1400	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1400	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1400	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1400	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1400	2004	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\sdkencryptedappticket.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\sdkencryptedappticket.dll",#1
2⤵
PID:1400