defb1185fbccd1cd3bcb6ed1ed0ab1556e181297cd13b5ebf3e1234e554da58d

Analysis

max time kernel
148s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 17:39

Target

AbyssGDPS/AbyssGDPS/libcocos2d.dll
Size

1.7MB
MD5

f727d33f2c0376e8ce5d97687f45cf2d
SHA1

6d077d6e13f7bf85baf158236b198daefe2bf7d2
SHA256

f5f78cfdd899304ea2ae413aac380fd2abd5b3a0431a2951b7cb9ae5dd379e01
SHA512

f6ea07958b4cfd9f7ade91576cf2e100515da1bd10e645e432da33b45bb75cdc38faff3266d8db61b764bbce5b5c163252a1f22e97f09c57ae7caa2384d5fb05
SSDEEP

24576:5F0WZtjHMT+6O/JYsqzHJ421WIMEgPuFZrjawGHOXLxp2rNzIQYO3i+:XZtdFPuJ4yDHrj7LkzIQYOv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2280	3520	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 3520	3168	rundll32.exe	91
PID 3168 wrote to memory of 3520	3168	rundll32.exe	91
PID 3168 wrote to memory of 3520	3168	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\libcocos2d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\libcocos2d.dll,#1
  2⤵
  PID:3520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 636
    3⤵
    - Program crash
    PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3520 -ip 3520
1⤵
PID:1040