defb1185fbccd1cd3bcb6ed1ed0ab1556e181297cd13b5ebf3e1234e554da58d

Analysis

max time kernel
148s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 17:39

Target

AbyssGDPS/AbyssGDPS/fmod.dll
Size

1.5MB
MD5

e036b79b842b22516584ba63edab26eb
SHA1

91d75a4160a57993e0f323e3e000ba768f57e8de
SHA256

6b713c704326f1029b3ca57ac65efb10192ab0708037827e8b9aab2281bc1655
SHA512

55c1f45e11b04e3e1dc08313c82c73fd7a03dd31310045b0cf90a18ea125173505f11a004d72440e1a1de3ed7760dfed98734d7c5caf6460e0f16a54e588b7e0
SSDEEP

24576:mARdVWMRasWlqnJnpLU55ofwM+ZuTqd1o/vnAE9UzwXJXv0C5co:meQPlUJnps+IRd1o/QwXJX8iB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1876	596	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 596	832	rundll32.exe	85
PID 832 wrote to memory of 596	832	rundll32.exe	85
PID 832 wrote to memory of 596	832	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\fmod.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AbyssGDPS\AbyssGDPS\fmod.dll,#1
  2⤵
  PID:596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 652
    3⤵
    - Program crash
    PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 596 -ip 596
1⤵
PID:3016