7882e839fc528d5a8d81f85c12abde672e99e8fcb2fb3a1c9d5956a605aebdb7

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 01:39

Target
360sdrun.exe
Size 838KB
Sample240510-b23atabc91
SHA256 91b8b0a0e2d30f8ce59a4e05ef752b9e44801b22041b29b5161abd827c16223f
MD5 a6aaefa01afdb245d73842bf9e1cc899
SHA1 04288b809f517cfb87c0cb354b13061eff234dd9
SHA512 286c11c64b3e0b7b1b0022bbb57b345f697c632ccfadc9ea06038c77ad182132cc4ea2ec9e4f7748360874ccac8463dd5ddd7c8b059ae165a6012830bfe77aaf
SSDEEP 12288:uiF6wN7fuwqCMKRuzSN76mWOqYQ1GJxoBa8b/hXGPeu3oXQUHj:7F6wNUauzSN76PnFGnSa8bhXG21XQ8j
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2088	1352	WerFault.exe	28

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1352	1952	360sdrun.exe	28
PID 1952 wrote to memory of 1352	1952	360sdrun.exe	28
PID 1952 wrote to memory of 1352	1952	360sdrun.exe	28
PID 1952 wrote to memory of 1352	1952	360sdrun.exe	28
PID 1352 wrote to memory of 2088	1352	repair.exe	29
PID 1352 wrote to memory of 2088	1352	repair.exe	29
PID 1352 wrote to memory of 2088	1352	repair.exe	29
PID 1352 wrote to memory of 2088	1352	repair.exe	29

C:\Users\Admin\AppData\Local\Temp\360sdrun.exe
"C:\Users\Admin\AppData\Local\Temp\360sdrun.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\Temp\repair.exe
  "C:\Users\Admin\AppData\Local\Temp\repair.exe" /URL:http://pinst.qihucdn.com/360sd/360sd_min.cab
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 216
    3⤵
    - Program crash
    PID:2088