52356abff533c337129af9b251bfb053f49e3e00ad2da2440e2111ad66ceabd7 | Triage

Analysis

max time kernel
361s
max time network
369s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
06/03/2025, 02:16

Sharing

Report Analysis Logs

General

Target

DCRat/data/DCRLC.exe
Size

23KB
MD5

a1bccb81f525f46b8e0994157f0dbb58
SHA1

70ad20203e56b1fed9827d87c8cc8ba09008a49f
SHA256

574f0612cef481f5bde5667586f1bf1c4df4b7672cd6093b6a8f3b2cadc10725
SHA512

9fe2dc5e4f621142d43b0ec8ced708b6fcd41c70b5432315ac98de632ab4a9e95bafb93dd30415b877ed6b2351697389cedd9285bdda7e53545e933b6c8de3be
SSDEEP

384:Yc/k09yBB7RBADETZc3+QrB4EXZcs7xaaMrbTywSUIk:07XmES+QrB4EXZX7/cnnSk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 2912	1556	DCRLC.exe	31
PID 1556 wrote to memory of 2912	1556	DCRLC.exe	31
PID 1556 wrote to memory of 2912	1556	DCRLC.exe	31

C:\Users\Admin\AppData\Local\Temp\DCRat\data\DCRLC.exe
"C:\Users\Admin\AppData\Local\Temp\DCRat\data\DCRLC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1556 -s 516
  2⤵
  PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1556-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/1556-1-0x00000000002A0000-0x00000000002AC000-memory.dmp

Filesize
48KB

Download