9f47be6e4eda3330a8ac3183926e7864f6eef329f697efd4d813173c651da57a

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 15:24

Target

SM2258XTMPToolQ0602A/Dll/SWPtest.dll
Size

393KB
MD5

1e840e4d0335f0dfe07e8f73f64000c6
SHA1

6417cad94283462d5fc81faada21afa618532e21
SHA256

78cb8f8471828448f4d6033a8975cddded99fafdb522b53376677876d2b499e3
SHA512

a70731f182eec7fd61f7858050e17d6bb9204015e8a03889d842d33d1e19bef43405d71701419a85617e60c8696464236bbfd4b8e953dedde04a4854bf04d57a
SSDEEP

6144:WU38bYp43HhlbhXn2rDuT9NEuWpdBqYtoFOEn:WUsbYp43HLhXnEDuzKt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1256	1956	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1956 wrote to memory of 1256	1956	rundll32.exe	29
PID 1956 wrote to memory of 1256	1956	rundll32.exe	29
PID 1956 wrote to memory of 1256	1956	rundll32.exe	29
PID 1956 wrote to memory of 1256	1956	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SM2258XTMPToolQ0602A\Dll\SWPtest.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SM2258XTMPToolQ0602A\Dll\SWPtest.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 228
    3⤵
    - Program crash
    PID:1256

memory/1956-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1956-56-0x0000000000250000-0x00000000002B9000-memory.dmp

Filesize
420KB

Download