e293d555fdb8c3486dd84b4a2b2e8dbfe9e67c3ba2879d03656de46e1bbf4358

Analysis

max time kernel
240s
max time network
290s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:01

Target

SBCL_ORF-AustriaSat_Bulsatcom_Canalsat_CNL_29022012/plugins/CSA/Optimized_CSA.dll
Size

44KB
MD5

1aec5a47356386e12f67ceeadb6e913d
SHA1

04cc297aa0655405e9de0c8bc9531a361e71c4df
SHA256

5332dc50716137a47c6785df301023445a52667a1899b629b66f8af9db4d154d
SHA512

0e8887e59859b1ca0708dc130a8ec0e9cc22e8fa7c705f3ed96bb261617450dcbee0ff78b0d7c7eba8187150242e973a99ec363ec3ef41e7d06eaf9dbb89af1e
SSDEEP

384:cWQ47tjqwVjqb86IyeRCxJN1he1VgWtyCyQ2BqltyWbwpgo9PJxC2Q:5QEgS2MyXAXyCA2oWcCo9xxg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2156	312	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 312	1712	rundll32.exe	27
PID 1712 wrote to memory of 312	1712	rundll32.exe	27
PID 1712 wrote to memory of 312	1712	rundll32.exe	27
PID 1712 wrote to memory of 312	1712	rundll32.exe	27
PID 1712 wrote to memory of 312	1712	rundll32.exe	27
PID 1712 wrote to memory of 312	1712	rundll32.exe	27
PID 1712 wrote to memory of 312	1712	rundll32.exe	27
PID 312 wrote to memory of 2156	312	rundll32.exe	28
PID 312 wrote to memory of 2156	312	rundll32.exe	28
PID 312 wrote to memory of 2156	312	rundll32.exe	28
PID 312 wrote to memory of 2156	312	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SBCL_ORF-AustriaSat_Bulsatcom_Canalsat_CNL_29022012\plugins\CSA\Optimized_CSA.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SBCL_ORF-AustriaSat_Bulsatcom_Canalsat_CNL_29022012\plugins\CSA\Optimized_CSA.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 312 -s 228
    3⤵
    - Program crash
    PID:2156