40a1f7057396a441de12bdf6d7ef4031061d049570bb7a35d902be14b1b0328a

Analysis

max time kernel
130s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2022, 11:57

Target

JPS_release/Jigsaw Puzzle Solver/_ssl.dll
Size

1.4MB
MD5

13ca13b396859fba5e2804f5bb557944
SHA1

efdb032807a37744b8ba308910f41cbdcfaa176b
SHA256

105ed89532d67449310c439057d72f20c280e6f0c26d37aef8915039ba6273bd
SHA512

4838715204043e8148e965b778e2ad7485f6b90ec86586958fff712ca7ea7dda39b6efe320a1d494abed6eecf5eca7c796662d0e9987c092cb54b3e595f7ef9d
SSDEEP

24576:hUNEFS9BPUJSxnBqwPvXY+XJi5GNcHe37i5WHjPPc5aiXkbo+KpP+dOWwqpJr5e4:hsZBMUnBPvXYN5JHU7iUDP7UPW9pJUxq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2160	4832	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 4832	1100	rundll32.exe	79
PID 1100 wrote to memory of 4832	1100	rundll32.exe	79
PID 1100 wrote to memory of 4832	1100	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\JPS_release\Jigsaw Puzzle Solver\_ssl.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\JPS_release\Jigsaw Puzzle Solver\_ssl.dll",#1
  2⤵
  PID:4832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 864
    3⤵
    - Program crash
    PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4832 -ip 4832
1⤵
PID:3596