7882e839fc528d5a8d81f85c12abde672e99e8fcb2fb3a1c9d5956a605aebdb7

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 01:39

Target
360sdrun.exe
Size 838KB
Sample240510-b23atabc91
SHA256 91b8b0a0e2d30f8ce59a4e05ef752b9e44801b22041b29b5161abd827c16223f
MD5 a6aaefa01afdb245d73842bf9e1cc899
SHA1 04288b809f517cfb87c0cb354b13061eff234dd9
SHA512 286c11c64b3e0b7b1b0022bbb57b345f697c632ccfadc9ea06038c77ad182132cc4ea2ec9e4f7748360874ccac8463dd5ddd7c8b059ae165a6012830bfe77aaf
SSDEEP 12288:uiF6wN7fuwqCMKRuzSN76mWOqYQ1GJxoBa8b/hXGPeu3oXQUHj:7F6wNUauzSN76PnFGnSa8bhXG21XQ8j
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4452	3316	WerFault.exe	92

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 3316	1896	360sdrun.exe	92
PID 1896 wrote to memory of 3316	1896	360sdrun.exe	92
PID 1896 wrote to memory of 3316	1896	360sdrun.exe	92

C:\Users\Admin\AppData\Local\Temp\360sdrun.exe
"C:\Users\Admin\AppData\Local\Temp\360sdrun.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Users\Admin\AppData\Local\Temp\repair.exe
  "C:\Users\Admin\AppData\Local\Temp\repair.exe" /URL:http://pinst.qihucdn.com/360sd/360sd_min.cab
  2⤵
  PID:3316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 608
    3⤵
    - Program crash
    PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3316 -ip 3316
1⤵
PID:2280