b4f3b5d4db14198aa37f16e96e09c265d5e7ce323852c25d5eb7fe26ba382147

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 20:58

Target

dc crack/RAT/data/DCRAC.exe
Size

26KB
MD5

8a1a98367fd8cb7aa977403f88152e60
SHA1

cb56f3348ef9b2bb6f38f3ef2b5522e64222b707
SHA256

730fdccacba82f334638c13a284ae2e8462e10382bf55d2a0d35f25b805bdc02
SHA512

a18dd788496c9d34c538cf547cf1bd3aeffd6c452d615a186c05222043b7bde5a03360cc33c9005951ff4bd076b4fecabeaf418b59d3623d604ff7b308d09e83
SSDEEP

768:DZIex9MGyfCCk5L+VUI5SNcGN0KttZZA9BCfNGJkvmNzJhCY2misDfb4oCij:tIegGy6CA+VT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1448	1152	DCRAC.exe	29
PID 1152 wrote to memory of 1448	1152	DCRAC.exe	29
PID 1152 wrote to memory of 1448	1152	DCRAC.exe	29

C:\Users\Admin\AppData\Local\Temp\dc crack\RAT\data\DCRAC.exe
"C:\Users\Admin\AppData\Local\Temp\dc crack\RAT\data\DCRAC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1152 -s 532
  2⤵
  PID:1448

memory/1152-0-0x0000000000350000-0x000000000035C000-memory.dmp

Filesize
48KB

Download
memory/1152-1-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

Filesize
9.9MB

Download
memory/1152-2-0x000000001AB80000-0x000000001AC9E000-memory.dmp

Filesize
1.1MB

Download
memory/1152-3-0x000000001AE80000-0x000000001AF00000-memory.dmp

Filesize
512KB

Download
memory/1152-4-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

Filesize
9.9MB

Download
memory/1152-5-0x000000001AE80000-0x000000001AF00000-memory.dmp

Filesize
512KB

Download