defb1185fbccd1cd3bcb6ed1ed0ab1556e181297cd13b5ebf3e1234e554da58d

Analysis

max time kernel
138s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 17:39

Target

AbyssGDPS/AbyssGDPS/websockets.dll
Size

75KB
MD5

e1db6e022098c0caec94c22cb81def3c
SHA1

ddfe57fe157446348706644b6908602bb02e401d
SHA256

528624dda7a00149c976268e1350cb884d825ed02afe52415299f55c65b7d346
SHA512

21dbcc0082eb1119804efe3162089ccdbce7a60ea6082046a08a8acc6a32e29030a3314ba35625d6ad7d20f6e79bf033b7271e3865731842714fa6dac6d0bce9
SSDEEP

1536:T8lzDqHQ7ZwUOfYZtZU5CYgEqRF09TQCIOBnToIfRAQhDx:T8lgqZwsPfKTQgpTBfRAQh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1492	392	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 392	4048	rundll32.exe	90
PID 4048 wrote to memory of 392	4048	rundll32.exe	90
PID 4048 wrote to memory of 392	4048	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\websockets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\websockets.dll,#1
  2⤵
  PID:392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 616
    3⤵
    - Program crash
    PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 392 -ip 392
1⤵
PID:4120