7d4564b8671eea0da70f632fc6231a0529e952782eaddbda3aa9d749e3339e5c

Resubmissions

20/08/2024, 20:56

20/08/2024, 20:55

20/08/2024, 20:55

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 20:55

Target

Executor/cpprest_2_10.dll
Size

950KB
MD5

f517b79251a9f9fc33b9e7c44771c5c8
SHA1

a919251abf2c02b4815828a434bcef9f43b8c3d5
SHA256

e1b087aae2411f97c06df984b769c08ea797e171722b3ef853b266203292a58d
SHA512

6dcc5947e29eb73c86419afed2aa435b9a5284da7934ac00bcb5743f6dd96643d7af2741136a4e45d69d13b6dc34fe31949cad91423b3a43621dcc534edc1a74
SSDEEP

24576:m0eE8Uexrrwz3mZBc2CGaqyN/fzWMDBJocWoHI+VK28xDdBLIjIBwkOBFRWUdE4:m0ebwz3mZBcCUlm4zp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2960	2684	rundll32.exe	30
PID 2684 wrote to memory of 2960	2684	rundll32.exe	30
PID 2684 wrote to memory of 2960	2684	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Executor\cpprest_2_10.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2684 -s 96
  2⤵
  PID:2960