8bc4d422624113b2af547b64fa7df842b821f189ca4d7bad6e75767fec4a9e59

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 17:28

Target
data/DCRCC.exe
Size 24KB
Sample240527-v2fllacf56
SHA256 8f5b38fdde20187e5ab965e60c024b98def9d565ea23f596da4fe13d12e5f5b8
MD5 7369469d49c34493f1b8a06fc89d9c7f
SHA1 956b5e6933b6c8141fe6aa16d97b15fc0e985e95
SHA512 1777cc2a5e11115d71b92c5790be558838aed0173a3d7ff288db44674a0b3151026515d74518a960c2467d9be549cd47567123b59330d7684a9b2919b707a1a3
SSDEEP 384:QVkGGnEOjdf9FZiJSi6gi8Yd6aHmcL/QKN+eglriL5nOIj3vFy:tFdf9CJ+F8IG1KGleNB5y
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	1384	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1992	1384	DCRCC.exe	29
PID 1384 wrote to memory of 1992	1384	DCRCC.exe	29
PID 1384 wrote to memory of 1992	1384	DCRCC.exe	29
PID 1384 wrote to memory of 1992	1384	DCRCC.exe	29

C:\Users\Admin\AppData\Local\Temp\data\DCRCC.exe
"C:\Users\Admin\AppData\Local\Temp\data\DCRCC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 544
  2⤵
  - Program crash
  PID:1992

memory/1384-0-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

Download

memory/1384-1-0x0000000000290000-0x000000000029C000-memory.dmp

Download

memory/1384-2-0x0000000074B30000-0x000000007521E000-memory.dmp

Download

memory/1384-3-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

Download