defb1185fbccd1cd3bcb6ed1ed0ab1556e181297cd13b5ebf3e1234e554da58d

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 17:39

Target

AbyssGDPS/AbyssGDPS/sdkencryptedappticket.dll
Size

839KB
MD5

8a06976f3e367105e258dca885ba221e
SHA1

203bd8e5fb1e19aef08f7a6b61544ac453ea846a
SHA256

7b984cd7db3564867b67c6f8c17c1625432a1ce486817dadd8f5bb79347d2f28
SHA512

b9fbfa675dd76ccd362a57c4672cf39d2928eb475fb2f320f432d1c680339667b1d99f213dbc48f565f8aa23b64ca7fa53041b52505a9b04cd039a09aba7547a
SSDEEP

12288:eUdxdeVj1VA+5PJcjFv321TfI3aXDXYMf96OBjVUiQ4hobvdFmwspj5HTsp3bVRI:eULdeVHZJcjFqf96OBRbSblspFTsxbPI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1636	1668	rundll32.exe	28
PID 1668 wrote to memory of 1636	1668	rundll32.exe	28
PID 1668 wrote to memory of 1636	1668	rundll32.exe	28
PID 1668 wrote to memory of 1636	1668	rundll32.exe	28
PID 1668 wrote to memory of 1636	1668	rundll32.exe	28
PID 1668 wrote to memory of 1636	1668	rundll32.exe	28
PID 1668 wrote to memory of 1636	1668	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\sdkencryptedappticket.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\sdkencryptedappticket.dll,#1
  2⤵
  PID:1636