Analysis

  • max time kernel
    138s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/11/2024, 05:03

General

  • Target

    Geometry Dash 2.11 Funcional/msvcp100.dll

  • Size

    411KB

  • MD5

    e3c817f7fe44cc870ecdbcbc3ea36132

  • SHA1

    2ada702a0c143a7ae39b7de16a4b5cc994d2548b

  • SHA256

    d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf

  • SHA512

    4fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe

  • SSDEEP

    12288:zNb8zxr1aWPaHX7dGP57rhUgiW6QR7t5qv3Ooc8UHkC2ejGH:zNb8Fpa6aHX7dGP5Kv3Ooc8UHkC2eKH

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.11 Funcional\msvcp100.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.11 Funcional\msvcp100.dll",#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:740
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 604
        3⤵
        • Program crash
        PID:3984
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 740 -ip 740
    1⤵
      PID:2056

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads