de08c69d06b2f176058aa6001b9f9195ef9599f1f79b783e21762046258583d3

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-03-2024 20:51

Target

dcrat/data/DCRCC.exe
Size

24KB
MD5

7369469d49c34493f1b8a06fc89d9c7f
SHA1

956b5e6933b6c8141fe6aa16d97b15fc0e985e95
SHA256

8f5b38fdde20187e5ab965e60c024b98def9d565ea23f596da4fe13d12e5f5b8
SHA512

1777cc2a5e11115d71b92c5790be558838aed0173a3d7ff288db44674a0b3151026515d74518a960c2467d9be549cd47567123b59330d7684a9b2919b707a1a3
SSDEEP

384:QVkGGnEOjdf9FZiJSi6gi8Yd6aHmcL/QKN+eglriL5nOIj3vFy:tFdf9CJ+F8IG1KGleNB5y

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2380 1708 WerFault.exe DCRCC.exe

pid	pid_target	process	target process
2380	1708	WerFault.exe	DCRCC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

DCRCC.exe

description	pid	process	target process
PID 1708 wrote to memory of 2380	1708	DCRCC.exe	WerFault.exe
PID 1708 wrote to memory of 2380	1708	DCRCC.exe	WerFault.exe
PID 1708 wrote to memory of 2380	1708	DCRCC.exe	WerFault.exe
PID 1708 wrote to memory of 2380	1708	DCRCC.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\dcrat\data\DCRCC.exe
"C:\Users\Admin\AppData\Local\Temp\dcrat\data\DCRCC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 548
  2⤵
  - Program crash
  PID:2380

memory/1708-0-0x0000000000CD0000-0x0000000000CDC000-memory.dmp

Filesize
48KB

Download
memory/1708-1-0x0000000074920000-0x000000007500E000-memory.dmp

Filesize
6.9MB

Download
memory/1708-2-0x0000000004710000-0x0000000004750000-memory.dmp

Filesize
256KB

Download
memory/1708-3-0x0000000074920000-0x000000007500E000-memory.dmp

Filesize
6.9MB

Download
memory/1708-4-0x0000000004710000-0x0000000004750000-memory.dmp

Filesize
256KB

Download