01cc2b1bca4a1a99bb6ae311ff222b788700913cb0ba765dbdee7f25160bf91a

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 06:47

Target

[CRACKED BY L1nc0In] NEW DCRat/DCRat/data/DCRBT.exe
Size

23KB
MD5

32e2bc4f79c776b542f6775895beaf21
SHA1

38e1d82f7cd869d1a016a94dc747110e44e80ae2
SHA256

98ec5492a2f0aeba5b39a9f41498d98c73643bf6d8d177e5831fb0ad6e6f8521
SHA512

4ed797827b33fc922b1385c7b4e1cfdc12f7e00c8969b7ed6eeb6aa82f2656fa7f73c90c67ee1a1fdff2ac654504e214d4255eb37251736d30fa694e0b3094e9
SSDEEP

384:Ik67YLzFJSKaj1A5l055eRethRv1WGqvSqRehTLONKwzI:P3JJ/V5lU5e8thRNwvI5LSKw0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2932	2680	DCRBT.exe	31
PID 2680 wrote to memory of 2932	2680	DCRBT.exe	31
PID 2680 wrote to memory of 2932	2680	DCRBT.exe	31

C:\Users\Admin\AppData\Local\Temp\[CRACKED BY L1nc0In] NEW DCRat\DCRat\data\DCRBT.exe
"C:\Users\Admin\AppData\Local\Temp\[CRACKED BY L1nc0In] NEW DCRat\DCRat\data\DCRBT.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2680 -s 504
  2⤵
  PID:2932

memory/2680-0-0x000007FEF5D33000-0x000007FEF5D34000-memory.dmp

Filesize
4KB

Download
memory/2680-1-0x00000000000B0000-0x00000000000BC000-memory.dmp

Filesize
48KB

Download