defb1185fbccd1cd3bcb6ed1ed0ab1556e181297cd13b5ebf3e1234e554da58d | Triage

Analysis

max time kernel
139s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 17:39

Sharing

Report Analysis Logs

General

Target

AbyssGDPS/AbyssGDPS/sqlite3.dll
Size

527KB
MD5

0ec32327447976d439358bc1db47cd31
SHA1

516e8df1b4cf92475b07131637b1f93cca27f077
SHA256

34057639b01413314a1b67c56c5d81e2aaa965f4eef1b9e11f2aa2261a628a0b
SHA512

448a81db8aebfd1907b039b14327948ae675683c704a86d8a9f38e2a2a91dcde7c99b6be04d97877bbc8d9405392b96e4e580d90a910243d9904943334a3ff6f
SSDEEP

12288:ZKyZVQn8QoxwgBFn32Q7bomYRJMdwm5HE8V:ZzcQHb2o4fB

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3508	3056	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 3056	2400	rundll32.exe	91
PID 2400 wrote to memory of 3056	2400	rundll32.exe	91
PID 2400 wrote to memory of 3056	2400	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\sqlite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\sqlite3.dll,#1
  2⤵
  PID:3056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 612
    3⤵
    - Program crash
    PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 3056 -ip 3056
1⤵
PID:3732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads