a3375d6f37d30f37ce07192cc83564c01c475abaa6acce9d2053f0c287bcb741

Analysis

max time kernel
21s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16/03/2023, 21:17 UTC

Target

Gacha Neon PCversion/Adobe AIR/Versions/1.0/Resources/WebKit.dll
Size

5.4MB
MD5

5de9fc896659ee0e9ecd0897cb15d1bf
SHA1

9b88296ee32bd13e14de40eeb9c748f0f9382ebf
SHA256

df04691727871b9b099a374cac70dd7e0808d992b6373b6fe6228107a5e224fb
SHA512

e9d8d9841a591c991bd1b48f19e90067390ac375d4cada59cb966abef6e9f3de8f6e9b701361485f6fed74273059acebc3a790d644dfdf3c651731513b943dda
SSDEEP

98304:xGThiaZTZOiAu+ajgYiFXVW6V7ufWCRTb+4DU8M:Y4gGYiFl3KWCVo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1348	1184	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 1184	1188	rundll32.exe	26
PID 1188 wrote to memory of 1184	1188	rundll32.exe	26
PID 1188 wrote to memory of 1184	1188	rundll32.exe	26
PID 1188 wrote to memory of 1184	1188	rundll32.exe	26
PID 1188 wrote to memory of 1184	1188	rundll32.exe	26
PID 1188 wrote to memory of 1184	1188	rundll32.exe	26
PID 1188 wrote to memory of 1184	1188	rundll32.exe	26
PID 1184 wrote to memory of 1348	1184	rundll32.exe	27
PID 1184 wrote to memory of 1348	1184	rundll32.exe	27
PID 1184 wrote to memory of 1348	1184	rundll32.exe	27
PID 1184 wrote to memory of 1348	1184	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Gacha Neon PCversion\Adobe AIR\Versions\1.0\Resources\WebKit.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Gacha Neon PCversion\Adobe AIR\Versions\1.0\Resources\WebKit.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 244
    3⤵
    - Program crash
    PID:1348