cd613a77676aef8c7913a1454974dd565d2450600df039cb6fc109f3d268df01

Analysis

max time kernel
29s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/05/2023, 02:58

Target

2023-05-18_49d65c4deac159e4cc362fdece101bdf_destroyer_sage.exe
Size

58KB
MD5

49d65c4deac159e4cc362fdece101bdf
SHA1

9f89cf91303cac5bf014eeec8cc92e43976bfaa4
SHA256

cd613a77676aef8c7913a1454974dd565d2450600df039cb6fc109f3d268df01
SHA512

9917d5babbfe5fed569eaa6f84453acecc305ec99a56e0669b967797a766d82088e738ecc881888530bcfd9f2961da6b3151353b03f1b9112046b438f91365e7
SSDEEP

1536:WF4HL5iOEGybPDUBqPhRoBKrZgzvYrg+SND4P:WF4HLltOhNVgzMzSNDE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1144	1684	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1144	1684	2023-05-18_49d65c4deac159e4cc362fdece101bdf_destroyer_sage.exe	26
PID 1684 wrote to memory of 1144	1684	2023-05-18_49d65c4deac159e4cc362fdece101bdf_destroyer_sage.exe	26
PID 1684 wrote to memory of 1144	1684	2023-05-18_49d65c4deac159e4cc362fdece101bdf_destroyer_sage.exe	26
PID 1684 wrote to memory of 1144	1684	2023-05-18_49d65c4deac159e4cc362fdece101bdf_destroyer_sage.exe	26

C:\Users\Admin\AppData\Local\Temp\2023-05-18_49d65c4deac159e4cc362fdece101bdf_destroyer_sage.exe
"C:\Users\Admin\AppData\Local\Temp\2023-05-18_49d65c4deac159e4cc362fdece101bdf_destroyer_sage.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 240
  2⤵
  - Program crash
  PID:1144