de08c69d06b2f176058aa6001b9f9195ef9599f1f79b783e21762046258583d3

Resubmissions

04-03-2024 05:33

04-03-2024 04:18

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 04:18

Target

dcrat/data/DCRCC.exe
Size

24KB
MD5

7369469d49c34493f1b8a06fc89d9c7f
SHA1

956b5e6933b6c8141fe6aa16d97b15fc0e985e95
SHA256

8f5b38fdde20187e5ab965e60c024b98def9d565ea23f596da4fe13d12e5f5b8
SHA512

1777cc2a5e11115d71b92c5790be558838aed0173a3d7ff288db44674a0b3151026515d74518a960c2467d9be549cd47567123b59330d7684a9b2919b707a1a3
SSDEEP

384:QVkGGnEOjdf9FZiJSi6gi8Yd6aHmcL/QKN+eglriL5nOIj3vFy:tFdf9CJ+F8IG1KGleNB5y

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2496 2052 WerFault.exe DCRCC.exe

pid	pid_target	process	target process
2496	2052	WerFault.exe	DCRCC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

DCRCC.exe

description	pid	process	target process
PID 2052 wrote to memory of 2496	2052	DCRCC.exe	WerFault.exe
PID 2052 wrote to memory of 2496	2052	DCRCC.exe	WerFault.exe
PID 2052 wrote to memory of 2496	2052	DCRCC.exe	WerFault.exe
PID 2052 wrote to memory of 2496	2052	DCRCC.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\dcrat\data\DCRCC.exe
"C:\Users\Admin\AppData\Local\Temp\dcrat\data\DCRCC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 540
2⤵
- Program crash
PID:2496

memory/2052-1-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2052-0-0x0000000000EA0000-0x0000000000EAC000-memory.dmp

Filesize
48KB

Download
memory/2052-2-0x0000000004400000-0x0000000004440000-memory.dmp

Filesize
256KB

Download
memory/2052-3-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2052-4-0x0000000004400000-0x0000000004440000-memory.dmp

Filesize
256KB

Download