defb1185fbccd1cd3bcb6ed1ed0ab1556e181297cd13b5ebf3e1234e554da58d

Analysis

max time kernel
122s
max time network
158s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/04/2024, 17:39

Target

AbyssGDPS/AbyssGDPS/libcocos2d.dll
Size

1.7MB
MD5

f727d33f2c0376e8ce5d97687f45cf2d
SHA1

6d077d6e13f7bf85baf158236b198daefe2bf7d2
SHA256

f5f78cfdd899304ea2ae413aac380fd2abd5b3a0431a2951b7cb9ae5dd379e01
SHA512

f6ea07958b4cfd9f7ade91576cf2e100515da1bd10e645e432da33b45bb75cdc38faff3266d8db61b764bbce5b5c163252a1f22e97f09c57ae7caa2384d5fb05
SSDEEP

24576:5F0WZtjHMT+6O/JYsqzHJ421WIMEgPuFZrjawGHOXLxp2rNzIQYO3i+:XZtdFPuJ4yDHrj7LkzIQYOv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	1900	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 1900	2492	rundll32.exe	30
PID 2492 wrote to memory of 1900	2492	rundll32.exe	30
PID 2492 wrote to memory of 1900	2492	rundll32.exe	30
PID 2492 wrote to memory of 1900	2492	rundll32.exe	30
PID 2492 wrote to memory of 1900	2492	rundll32.exe	30
PID 2492 wrote to memory of 1900	2492	rundll32.exe	30
PID 2492 wrote to memory of 1900	2492	rundll32.exe	30
PID 1900 wrote to memory of 2604	1900	rundll32.exe	31
PID 1900 wrote to memory of 2604	1900	rundll32.exe	31
PID 1900 wrote to memory of 2604	1900	rundll32.exe	31
PID 1900 wrote to memory of 2604	1900	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\libcocos2d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\libcocos2d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 260
    3⤵
    - Program crash
    PID:2604