01cc2b1bca4a1a99bb6ae311ff222b788700913cb0ba765dbdee7f25160bf91a

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 06:47

Target

[CRACKED BY L1nc0In] NEW DCRat/DCRat/data/DCRLC.exe
Size

23KB
MD5

a1bccb81f525f46b8e0994157f0dbb58
SHA1

70ad20203e56b1fed9827d87c8cc8ba09008a49f
SHA256

574f0612cef481f5bde5667586f1bf1c4df4b7672cd6093b6a8f3b2cadc10725
SHA512

9fe2dc5e4f621142d43b0ec8ced708b6fcd41c70b5432315ac98de632ab4a9e95bafb93dd30415b877ed6b2351697389cedd9285bdda7e53545e933b6c8de3be
SSDEEP

384:Yc/k09yBB7RBADETZc3+QrB4EXZcs7xaaMrbTywSUIk:07XmES+QrB4EXZX7/cnnSk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2232	1820	DCRLC.exe	31
PID 1820 wrote to memory of 2232	1820	DCRLC.exe	31
PID 1820 wrote to memory of 2232	1820	DCRLC.exe	31

C:\Users\Admin\AppData\Local\Temp\[CRACKED BY L1nc0In] NEW DCRat\DCRat\data\DCRLC.exe
"C:\Users\Admin\AppData\Local\Temp\[CRACKED BY L1nc0In] NEW DCRat\DCRat\data\DCRLC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1820 -s 520
  2⤵
  PID:2232

memory/1820-0-0x000007FEF5E83000-0x000007FEF5E84000-memory.dmp

Filesize
4KB

Download
memory/1820-1-0x0000000000B30000-0x0000000000B3C000-memory.dmp

Filesize
48KB

Download