a3375d6f37d30f37ce07192cc83564c01c475abaa6acce9d2053f0c287bcb741

Analysis

max time kernel
93s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2023 21:17

Target

Gacha Neon PCversion/Adobe AIR/Versions/1.0/Resources/WebKit.dll
Size

5.4MB
MD5

5de9fc896659ee0e9ecd0897cb15d1bf
SHA1

9b88296ee32bd13e14de40eeb9c748f0f9382ebf
SHA256

df04691727871b9b099a374cac70dd7e0808d992b6373b6fe6228107a5e224fb
SHA512

e9d8d9841a591c991bd1b48f19e90067390ac375d4cada59cb966abef6e9f3de8f6e9b701361485f6fed74273059acebc3a790d644dfdf3c651731513b943dda
SSDEEP

98304:xGThiaZTZOiAu+ajgYiFXVW6V7ufWCRTb+4DU8M:Y4gGYiFl3KWCVo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2084	1040	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1040	2168	rundll32.exe	85
PID 2168 wrote to memory of 1040	2168	rundll32.exe	85
PID 2168 wrote to memory of 1040	2168	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Gacha Neon PCversion\Adobe AIR\Versions\1.0\Resources\WebKit.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Gacha Neon PCversion\Adobe AIR\Versions\1.0\Resources\WebKit.dll",#1
  2⤵
  PID:1040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 672
    3⤵
    - Program crash
    PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1040 -ip 1040
1⤵
PID:236