fdca31d917022c94f32a0194f558db3bad4e89874f316b61950d670bdf0deff0

Analysis

max time kernel
1650s
max time network
1149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 10:11

Target

Geometry Dash/libcocos2d.dll
Size

1.7MB
MD5

d7a14d6968fd882af43f423e730a18a0
SHA1

7b81de3bd557c8b81646153bf1e8a2d7c71244af
SHA256

fb36d6b2090ebaf33d07dcb6461d8b52657ebf2335ba31230f0349e7b84e036c
SHA512

9c25a9374af552645ed429575e48d8a9fa742960eabd150de759963f19abdd2f9ea8811d6573175958fdd72fad56e221f65869a0c0582528e8d5cd473109f089
SSDEEP

24576:oTtLEJxHemGJY5l4ZazpD+gWfTe6AcAf9yw0UbSkig+QYOcUZEvN:oTt4oi1CW9yw4Rg+QYOV

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4908 4176 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4908	4176	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2300 wrote to memory of 4176	2300	rundll32.exe	rundll32.exe
PID 2300 wrote to memory of 4176	2300	rundll32.exe	rundll32.exe
PID 2300 wrote to memory of 4176	2300	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\libcocos2d.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash\libcocos2d.dll",#1
2⤵
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 644
3⤵
- Program crash
PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4176 -ip 4176
1⤵
PID:5028