52356abff533c337129af9b251bfb053f49e3e00ad2da2440e2111ad66ceabd7 | Triage

Analysis

max time kernel
359s
max time network
366s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
06/03/2025, 02:16

Sharing

Report Analysis Logs

General

Target

DCRat/data/DCRBC.exe
Size

26KB
MD5

14a56e4b7bd40512b49d6f72086e8fc1
SHA1

d8c05adc75d739a56c63d6596d460304eb219cc6
SHA256

86c45fb7473e5c1df78b8cbb2003033c37b4cb01a677c1ef30ca1573e84ec692
SHA512

3d5c2010963694262dcb08337f80190630d890565a25610c33983268afad11b0882fb5c7a03b5e629560d3fd1b9b3856d4896f5a272c53928c1fd10924e3b3f8
SSDEEP

384:7P0jnfJQhdPTfmUi5YbS8ISIfKfLOI87oRehG6VBVHCHljIhzqb:4YdxccSHSjfLOIyoRet9iHWhzm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2900	2340	DCRBC.exe	32
PID 2340 wrote to memory of 2900	2340	DCRBC.exe	32
PID 2340 wrote to memory of 2900	2340	DCRBC.exe	32

C:\Users\Admin\AppData\Local\Temp\DCRat\data\DCRBC.exe
"C:\Users\Admin\AppData\Local\Temp\DCRat\data\DCRBC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2340 -s 528
  2⤵
  PID:2900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2340-0-0x000007FEF4F13000-0x000007FEF4F14000-memory.dmp

Filesize
4KB

Download
memory/2340-1-0x0000000000EE0000-0x0000000000EEC000-memory.dmp

Filesize
48KB

Download
memory/2340-2-0x000000001AD20000-0x000000001AE3E000-memory.dmp

Filesize
1.1MB

Download