f116fee3e97f60151e38e411ab593aa9012db942e00f6591623fba3524bcb12f

Analysis

user interaction
yes
max time kernel
20s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 17:00

Target
Geometry-Dash-SteamRIP.com.rar
Size 319.3MB
Sample260419-vh6cxae14k
SHA256 f116fee3e97f60151e38e411ab593aa9012db942e00f6591623fba3524bcb12f
MD5 65c9641c5640597c01e5e1cc37e4566a
SHA1 01281aad34a785d96e62ac051c757fc857a312ac
SHA512 7a8e7b1182dcc79e1b2e1667beb3246b3c860c3561c65a27d7aad051832aecd4f388fa324326c47fe8e182db0ee8c5cd9173a869d159391a846314c8aab9f0d9
SSDEEP 6291456:MPTdSAYjpSOk7xOQzuvGpq8XWFsmSQdLl7R44fv10+EPW/VakeIiNzPFoLTsSs:QdSAYfkAQzR88GFsmSelpHO+EPHXoXK
TLSH
T16EF833A362EA50BFC2B5B26A043045523EB3C457D43DF105ED8593F3C2FAAE9A5E0D19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3580	GeometryDash.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4352	7zFM.exe
4352	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4352	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4352	7zFM.exe
4352	7zFM.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 3580	4352	7zFM.exe	85

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Geometry-Dash-SteamRIP.com.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Users\Admin\AppData\Local\Temp\7zO00153BA8\GeometryDash.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO00153BA8\GeometryDash.exe"
  2⤵
  - Executes dropped EXE
  PID:3580

GeometryDash.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO00153BA8\GeometryDash.exe
Size 10.2MB
SHA256 fc5a16c292278bc2e8e078fb1d5023c2bd658322dd72712767ea70c2dd9ec6d0
MD5 86c9fed4084cda75ff4ec648063a6769
SHA1 cab5d760ecac53e5bbfcb3a1fbd67754fd504d74
SHA512 cb03601e93e2f51a655e60c173a3353c2fbbfc3d69ded4a962d353761fa18f6235615fcddf680a75f4f372f19dbef1fe2b6349d981a8e0526756a38a1968a0e5
SSDEEP 98304:mxqymadz099aZ57ZNL2SeuFJ5hKLi7fDBoVxfS+VxfS:mxqymMA/aZ57ZNL2SeuFJ5EeT+LfL
TLSH
T1E9B63961A76405CBD0D18AB8C769F632C672BCC8A330649349E1BD27BF5B0E31D7992D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4352-9-0x000001D241C70000-0x000001D2420E2000-memory.dmp

Download