098997ad78b299915a440140fcc0f11d674effaf4675973388d547ec49e05ddd

Analysis

max time kernel
134s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
30-06-2024 05:15

Target

Geometry Dash PC (v2.204)/steam_api.dll
Size

1.4MB
MD5

864735f10140a1dae1fb2495eafff3ae
SHA1

65a4a28432d1827ca0af8cf3513ee60ddaadbe4c
SHA256

eaeaf26f60229ae4d1a9aae07d03ab4e93ea599dd883eb810d6adebcf0e52e14
SHA512

6efc09df0a24ce40196497b1fde96fa18488b5b9382bef36382929e75e57d2086193668b22c492453d3045ffe61a6fa9216a777276973be4e076fc187f2bc7ea
SSDEEP

24576:nMqRuY44tx6HXPYhPM5vtkelg+5tvtxTrl6mEfceT2lRLnx3N4FbqV9rssnwC7ot:nMlYKNtvgQttxTrl6y3V+bqPFnwCg39t

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 3596	772	rundll32.exe	80
PID 772 wrote to memory of 3596	772	rundll32.exe	80
PID 772 wrote to memory of 3596	772	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash PC (v2.204)\steam_api.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash PC (v2.204)\steam_api.dll",#1
  2⤵
  PID:3596