005f07797d5948b5d327bb60261fba73dba8ed19f5288dc570d8226ef97b463a | Triage

Analysis

max time kernel
23s
max time network
19s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24-11-2023 13:45

Sharing

Report Analysis Logs

General

Target

Geometry Dash/websockets.dll
Size

75KB
MD5

e1db6e022098c0caec94c22cb81def3c
SHA1

ddfe57fe157446348706644b6908602bb02e401d
SHA256

528624dda7a00149c976268e1350cb884d825ed02afe52415299f55c65b7d346
SHA512

21dbcc0082eb1119804efe3162089ccdbce7a60ea6082046a08a8acc6a32e29030a3314ba35625d6ad7d20f6e79bf033b7271e3865731842714fa6dac6d0bce9
SSDEEP

1536:T8lzDqHQ7ZwUOfYZtZU5CYgEqRF09TQCIOBnToIfRAQhDx:T8lgqZwsPfKTQgpTBfRAQh

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1924 2760 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1948 wrote to memory of 2760	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2760	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2760	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2760	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2760	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2760	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 2760	1948	rundll32.exe	rundll32.exe
PID 2760 wrote to memory of 1924	2760	rundll32.exe	WerFault.exe
PID 2760 wrote to memory of 1924	2760	rundll32.exe	WerFault.exe
PID 2760 wrote to memory of 1924	2760	rundll32.exe	WerFault.exe
PID 2760 wrote to memory of 1924	2760	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\websockets.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\websockets.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 224
3⤵
- Program crash
PID:1924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads