defb1185fbccd1cd3bcb6ed1ed0ab1556e181297cd13b5ebf3e1234e554da58d

Analysis

max time kernel
118s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/04/2024, 17:39

Target

AbyssGDPS/AbyssGDPS/abyssgdps.exe
Size

8.5MB
MD5

b0cda5700b3604fa44c068359fdb9711
SHA1

02a474211ef61c794901403e5f83d35155416a43
SHA256

2935911c30d255e2b3995102c2c9d58c0d1112a0b7dd21449a2c20bd8a3f7052
SHA512

101ad56d334f2d646200503cc519890411abc3050e0d4395f997bb81e3c3ab71adc22f259ad9757ce809a5f30c97e0f9962dc598bb9059e8bb11d0aad0329a5c
SSDEEP

98304:AV+mMdl51ycMEUGNmOw/abBRtIQ1Pdhb4JmULWpcoCZvsj6r2t9+ESeT0mdmC4Do:AsmMrBMEjUOPdM0ULfL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1760	2912	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 1760	2912	abyssgdps.exe	28
PID 2912 wrote to memory of 1760	2912	abyssgdps.exe	28
PID 2912 wrote to memory of 1760	2912	abyssgdps.exe	28
PID 2912 wrote to memory of 1760	2912	abyssgdps.exe	28

C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\abyssgdps.exe
"C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\abyssgdps.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 348
  2⤵
  - Program crash
  PID:1760