defb1185fbccd1cd3bcb6ed1ed0ab1556e181297cd13b5ebf3e1234e554da58d

Analysis

max time kernel
120s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/04/2024, 17:39

Target

AbyssGDPS/AbyssGDPS/libExtensions.dll
Size

281KB
MD5

1007b1f216530944edcaca4942b44ea7
SHA1

78ab1fe1c3b7e87d3a7c27e5d83bd56049b108e5
SHA256

3679d54757def30410c291f153dbb4ec88f8ef0dd3057ec0f2ebbcec53670566
SHA512

a9058f7d75a11536037b29a8d5b41be84d6bc338148282aae17423085228d9f7483b5996301c7d3f8b43dfe860e6839489d158021a4bbe976159ea27585413ef
SSDEEP

6144:EBJcwigsUb7pvN+5wWL3RgcGRWIufJ5Q0M+KM:UJcwHbVF+5wU33hJx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2872	2268	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2268	1908	rundll32.exe	28
PID 1908 wrote to memory of 2268	1908	rundll32.exe	28
PID 1908 wrote to memory of 2268	1908	rundll32.exe	28
PID 1908 wrote to memory of 2268	1908	rundll32.exe	28
PID 1908 wrote to memory of 2268	1908	rundll32.exe	28
PID 1908 wrote to memory of 2268	1908	rundll32.exe	28
PID 1908 wrote to memory of 2268	1908	rundll32.exe	28
PID 2268 wrote to memory of 2872	2268	rundll32.exe	29
PID 2268 wrote to memory of 2872	2268	rundll32.exe	29
PID 2268 wrote to memory of 2872	2268	rundll32.exe	29
PID 2268 wrote to memory of 2872	2268	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\libExtensions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\libExtensions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 260
    3⤵
    - Program crash
    PID:2872