de08c69d06b2f176058aa6001b9f9195ef9599f1f79b783e21762046258583d3

Resubmissions

04-03-2024 05:33

04-03-2024 04:18

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 04:18

Target

dcrat/data/DCRAC.exe
Size

26KB
MD5

8a1a98367fd8cb7aa977403f88152e60
SHA1

cb56f3348ef9b2bb6f38f3ef2b5522e64222b707
SHA256

730fdccacba82f334638c13a284ae2e8462e10382bf55d2a0d35f25b805bdc02
SHA512

a18dd788496c9d34c538cf547cf1bd3aeffd6c452d615a186c05222043b7bde5a03360cc33c9005951ff4bd076b4fecabeaf418b59d3623d604ff7b308d09e83
SSDEEP

768:DZIex9MGyfCCk5L+VUI5SNcGN0KttZZA9BCfNGJkvmNzJhCY2misDfb4oCij:tIegGy6CA+VT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

DCRAC.exe

description	pid	process	target process
PID 1764 wrote to memory of 1924	1764	DCRAC.exe	WerFault.exe
PID 1764 wrote to memory of 1924	1764	DCRAC.exe	WerFault.exe
PID 1764 wrote to memory of 1924	1764	DCRAC.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\dcrat\data\DCRAC.exe
"C:\Users\Admin\AppData\Local\Temp\dcrat\data\DCRAC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1764 -s 524
  2⤵
  PID:1924

memory/1764-0-0x00000000013C0000-0x00000000013CC000-memory.dmp

Filesize
48KB

Download
memory/1764-1-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

Filesize
9.9MB

Download
memory/1764-2-0x0000000001090000-0x00000000011AE000-memory.dmp

Filesize
1.1MB

Download
memory/1764-3-0x00000000003E0000-0x0000000000460000-memory.dmp

Filesize
512KB

Download
memory/1764-4-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

Filesize
9.9MB

Download
memory/1764-5-0x00000000003E0000-0x0000000000460000-memory.dmp

Filesize
512KB

Download