de08c69d06b2f176058aa6001b9f9195ef9599f1f79b783e21762046258583d3

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-03-2024 20:51

Target

dcrat/data/DCRAC.exe
Size

26KB
MD5

8a1a98367fd8cb7aa977403f88152e60
SHA1

cb56f3348ef9b2bb6f38f3ef2b5522e64222b707
SHA256

730fdccacba82f334638c13a284ae2e8462e10382bf55d2a0d35f25b805bdc02
SHA512

a18dd788496c9d34c538cf547cf1bd3aeffd6c452d615a186c05222043b7bde5a03360cc33c9005951ff4bd076b4fecabeaf418b59d3623d604ff7b308d09e83
SSDEEP

768:DZIex9MGyfCCk5L+VUI5SNcGN0KttZZA9BCfNGJkvmNzJhCY2misDfb4oCij:tIegGy6CA+VT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

DCRAC.exe

description	pid	process	target process
PID 2212 wrote to memory of 2516	2212	DCRAC.exe	WerFault.exe
PID 2212 wrote to memory of 2516	2212	DCRAC.exe	WerFault.exe
PID 2212 wrote to memory of 2516	2212	DCRAC.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\dcrat\data\DCRAC.exe
"C:\Users\Admin\AppData\Local\Temp\dcrat\data\DCRAC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2212 -s 524
  2⤵
  PID:2516

memory/2212-0-0x0000000000A60000-0x0000000000A6C000-memory.dmp

Filesize
48KB

Download
memory/2212-1-0x000000001ACE0000-0x000000001ADFE000-memory.dmp

Filesize
1.1MB

Download
memory/2212-2-0x000007FEF5990000-0x000007FEF637C000-memory.dmp

Filesize
9.9MB

Download
memory/2212-3-0x000000001AFF0000-0x000000001B070000-memory.dmp

Filesize
512KB

Download
memory/2212-4-0x000007FEF5990000-0x000007FEF637C000-memory.dmp

Filesize
9.9MB

Download
memory/2212-5-0x000000001AFF0000-0x000000001B070000-memory.dmp

Filesize
512KB

Download