defb1185fbccd1cd3bcb6ed1ed0ab1556e181297cd13b5ebf3e1234e554da58d

Analysis

max time kernel
1s
max time network
38s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 17:39

Target

AbyssGDPS/AbyssGDPS/websockets.dll
Size

75KB
MD5

e1db6e022098c0caec94c22cb81def3c
SHA1

ddfe57fe157446348706644b6908602bb02e401d
SHA256

528624dda7a00149c976268e1350cb884d825ed02afe52415299f55c65b7d346
SHA512

21dbcc0082eb1119804efe3162089ccdbce7a60ea6082046a08a8acc6a32e29030a3314ba35625d6ad7d20f6e79bf033b7271e3865731842714fa6dac6d0bce9
SSDEEP

1536:T8lzDqHQ7ZwUOfYZtZU5CYgEqRF09TQCIOBnToIfRAQhDx:T8lgqZwsPfKTQgpTBfRAQh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	2756	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2756	2736	rundll32.exe	30
PID 2736 wrote to memory of 2756	2736	rundll32.exe	30
PID 2736 wrote to memory of 2756	2736	rundll32.exe	30
PID 2736 wrote to memory of 2756	2736	rundll32.exe	30
PID 2736 wrote to memory of 2756	2736	rundll32.exe	30
PID 2736 wrote to memory of 2756	2736	rundll32.exe	30
PID 2736 wrote to memory of 2756	2736	rundll32.exe	30
PID 2756 wrote to memory of 2864	2756	rundll32.exe	31
PID 2756 wrote to memory of 2864	2756	rundll32.exe	31
PID 2756 wrote to memory of 2864	2756	rundll32.exe	31
PID 2756 wrote to memory of 2864	2756	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\websockets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\websockets.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 224
    3⤵
    - Program crash
    PID:2864