defb1185fbccd1cd3bcb6ed1ed0ab1556e181297cd13b5ebf3e1234e554da58d

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 17:39

Target

AbyssGDPS/AbyssGDPS/steam_api.dll
Size

1.4MB
MD5

864735f10140a1dae1fb2495eafff3ae
SHA1

65a4a28432d1827ca0af8cf3513ee60ddaadbe4c
SHA256

eaeaf26f60229ae4d1a9aae07d03ab4e93ea599dd883eb810d6adebcf0e52e14
SHA512

6efc09df0a24ce40196497b1fde96fa18488b5b9382bef36382929e75e57d2086193668b22c492453d3045ffe61a6fa9216a777276973be4e076fc187f2bc7ea
SSDEEP

24576:nMqRuY44tx6HXPYhPM5vtkelg+5tvtxTrl6mEfceT2lRLnx3N4FbqV9rssnwC7ot:nMlYKNtvgQttxTrl6y3V+bqPFnwCg39t

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 3108	3116	rundll32.exe	91
PID 3116 wrote to memory of 3108	3116	rundll32.exe	91
PID 3116 wrote to memory of 3108	3116	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\steam_api.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\steam_api.dll,#1
  2⤵
  PID:3108