005f07797d5948b5d327bb60261fba73dba8ed19f5288dc570d8226ef97b463a | Triage

Analysis

max time kernel
119s
max time network
139s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
24-11-2023 13:45

Sharing

Report Analysis Logs

General

Target

Geometry Dash/sqlite3.dll
Size

527KB
MD5

0ec32327447976d439358bc1db47cd31
SHA1

516e8df1b4cf92475b07131637b1f93cca27f077
SHA256

34057639b01413314a1b67c56c5d81e2aaa965f4eef1b9e11f2aa2261a628a0b
SHA512

448a81db8aebfd1907b039b14327948ae675683c704a86d8a9f38e2a2a91dcde7c99b6be04d97877bbc8d9405392b96e4e580d90a910243d9904943334a3ff6f
SSDEEP

12288:ZKyZVQn8QoxwgBFn32Q7bomYRJMdwm5HE8V:ZzcQHb2o4fB

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3040 2652 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1824 wrote to memory of 2652	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 2652	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 2652	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 2652	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 2652	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 2652	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 2652	1824	rundll32.exe	rundll32.exe
PID 2652 wrote to memory of 3040	2652	rundll32.exe	WerFault.exe
PID 2652 wrote to memory of 3040	2652	rundll32.exe	WerFault.exe
PID 2652 wrote to memory of 3040	2652	rundll32.exe	WerFault.exe
PID 2652 wrote to memory of 3040	2652	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\sqlite3.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\sqlite3.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 224
3⤵
- Program crash
PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads