253d8dcbf9eccdf4ddf6f5357a654d6c2c06bf0eeadf22234b81d81a59c0d74a

Analysis

max time kernel
182s
max time network
201s
platform
windows10-1703_x64
resource
win10-20231023-en
resource tags

arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system
submitted
15-11-2023 13:11

Target

data/DCRCC.exe
Size

24KB
MD5

7369469d49c34493f1b8a06fc89d9c7f
SHA1

956b5e6933b6c8141fe6aa16d97b15fc0e985e95
SHA256

8f5b38fdde20187e5ab965e60c024b98def9d565ea23f596da4fe13d12e5f5b8
SHA512

1777cc2a5e11115d71b92c5790be558838aed0173a3d7ff288db44674a0b3151026515d74518a960c2467d9be549cd47567123b59330d7684a9b2919b707a1a3
SSDEEP

384:QVkGGnEOjdf9FZiJSi6gi8Yd6aHmcL/QKN+eglriL5nOIj3vFy:tFdf9CJ+F8IG1KGleNB5y

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1228	4224	WerFault.exe	70
1084	4224	WerFault.exe	70

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 1228	4224	DCRCC.exe	73
PID 4224 wrote to memory of 1228	4224	DCRCC.exe	73
PID 4224 wrote to memory of 1228	4224	DCRCC.exe	73

C:\Users\Admin\AppData\Local\Temp\data\DCRCC.exe
"C:\Users\Admin\AppData\Local\Temp\data\DCRCC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 792
  2⤵
  - Program crash
  PID:1228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 792
  2⤵
  - Program crash
  PID:1084

memory/4224-0-0x0000000000C20000-0x0000000000C2C000-memory.dmp

Filesize
48KB

Download
memory/4224-1-0x0000000073420000-0x0000000073B0E000-memory.dmp

Filesize
6.9MB

Download
memory/4224-2-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/4224-3-0x0000000073420000-0x0000000073B0E000-memory.dmp

Filesize
6.9MB

Download
memory/4224-4-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download