CrySome RAT abe_decrypt.dll Dropped to Temp and Injected into Relaunched Browser
Detects the dropping of a suspicious DLL file ('abe_decrypt.dll') in a temporary directory, followed by the termination and relaunch of a browser process (Chrome, Edge, or Brave), and the subsequent loading of the same DLL into the browser process, which is highly indicative of browser process injection and DLL hijacking activity.
Cortex XDR
