fdca31d917022c94f32a0194f558db3bad4e89874f316b61950d670bdf0deff0 | Triage

Analysis

max time kernel
1800s
max time network
1819s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 10:11

Sharing

Report Analysis Logs

General

Target

Geometry Dash/libExtensions.dll
Size

280KB
MD5

bf4f9ca8bc5a1aa24603ece1f5dd3e62
SHA1

5692a5ee0b107f32c2359574470e14ff4fe572f3
SHA256

ce0f52884650e3e9779e034d4ba02baae57c3635f6d721e57440f2e29c97e6c1
SHA512

18bfe58c8c7ded74365c40dfd7cfa593a8ec5af2b7f7457ea88211e9aa8ecc146dc140fae9e5e5821c9291a76ddf269e76ce54645d5584933bf17e94dfb1cf8f
SSDEEP

6144:2jjeDzyKCMijQaErrHr5Cx7D7gcGRCYG6Ls5QQMe2:JDzyBjZMHr5Cx7DPgLs

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2084 2064 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2812 wrote to memory of 2064	2812	rundll32.exe	rundll32.exe
PID 2812 wrote to memory of 2064	2812	rundll32.exe	rundll32.exe
PID 2812 wrote to memory of 2064	2812	rundll32.exe	rundll32.exe
PID 2812 wrote to memory of 2064	2812	rundll32.exe	rundll32.exe
PID 2812 wrote to memory of 2064	2812	rundll32.exe	rundll32.exe
PID 2812 wrote to memory of 2064	2812	rundll32.exe	rundll32.exe
PID 2812 wrote to memory of 2064	2812	rundll32.exe	rundll32.exe
PID 2064 wrote to memory of 2084	2064	rundll32.exe	WerFault.exe
PID 2064 wrote to memory of 2084	2064	rundll32.exe	WerFault.exe
PID 2064 wrote to memory of 2084	2064	rundll32.exe	WerFault.exe
PID 2064 wrote to memory of 2084	2064	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\libExtensions.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2812

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\libExtensions.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 268
3⤵
- Program crash
PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads