defb1185fbccd1cd3bcb6ed1ed0ab1556e181297cd13b5ebf3e1234e554da58d

Analysis

max time kernel
122s
max time network
158s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 17:39

Target

AbyssGDPS/AbyssGDPS/fmod.dll
Size

1.5MB
MD5

e036b79b842b22516584ba63edab26eb
SHA1

91d75a4160a57993e0f323e3e000ba768f57e8de
SHA256

6b713c704326f1029b3ca57ac65efb10192ab0708037827e8b9aab2281bc1655
SHA512

55c1f45e11b04e3e1dc08313c82c73fd7a03dd31310045b0cf90a18ea125173505f11a004d72440e1a1de3ed7760dfed98734d7c5caf6460e0f16a54e588b7e0
SSDEEP

24576:mARdVWMRasWlqnJnpLU55ofwM+ZuTqd1o/vnAE9UzwXJXv0C5co:meQPlUJnps+IRd1o/QwXJX8iB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2224	2200	rundll32.exe	30
PID 2200 wrote to memory of 2224	2200	rundll32.exe	30
PID 2200 wrote to memory of 2224	2200	rundll32.exe	30
PID 2200 wrote to memory of 2224	2200	rundll32.exe	30
PID 2200 wrote to memory of 2224	2200	rundll32.exe	30
PID 2200 wrote to memory of 2224	2200	rundll32.exe	30
PID 2200 wrote to memory of 2224	2200	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\fmod.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\fmod.dll,#1
  2⤵
  PID:2224