File name:

0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe

Full analysis: https://app.any.run/tasks/ea7f9825-aeb5-4c47-b8de-5edb10f97bfe
Verdict: Malicious activity
Analysis date: April 09, 2025, 02:15:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections
MD5:

8CF28D39933C299F24876252DAF55BAB

SHA1:

3DA9FD77CF4029D9244382EB00AF452484D109A8

SHA256:

0D54D32363E61018CFCF27AA874FD0E79B1FEF37C9B7ECA776C7FB7435A2E21D

SSDEEP:

12288:st7UZeQg3vTN0J7hJNPmuBL+I1+surcsd8kUOiC9W5i:st7UZeFvQJNOuBL+I1+sAcsakUHQ3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe (PID: 4220)
      • 0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe (PID: 6700)
      • SQLSerasi.exe (PID: 7148)
      • SQLSerasi.exe (PID: 2504)
      • SQLSerasi.exe (PID: 6036)
      • SQLSerasi.exe (PID: 1300)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe (PID: 4220)

    • Starts itself from another location

      • 0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe (PID: 4220)

    • Reads security settings of Internet Explorer

      • 0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe (PID: 4220)
      • SQLSerasi.exe (PID: 6036)

    • Creates or modifies Windows services

      • SQLSerasi.exe (PID: 7148)
      • SQLSerasi.exe (PID: 6036)

    • Executes as Windows Service

      • SQLSerasi.exe (PID: 2504)

    • Application launched itself

      • SQLSerasi.exe (PID: 2504)

    • Executes application which crashes

      • SQLSerasi.exe (PID: 2504)

    • There is functionality for taking screenshot (YARA)

      • SQLSerasi.exe (PID: 6036)

  • INFO

    • Creates files in the program directory

      • 0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe (PID: 4220)

    • The sample compiled with chinese language support

      • 0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe (PID: 4220)

    • Checks supported languages

      • 0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe (PID: 4220)
      • SQLSerasi.exe (PID: 7148)
      • SQLSerasi.exe (PID: 2504)
      • SQLSerasi.exe (PID: 1300)
      • SQLSerasi.exe (PID: 6036)

    • Reads the computer name

      • 0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe (PID: 4220)
      • SQLSerasi.exe (PID: 7148)
      • SQLSerasi.exe (PID: 2504)
      • SQLSerasi.exe (PID: 1300)
      • SQLSerasi.exe (PID: 6036)

    • Process checks computer location settings

      • 0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe (PID: 4220)

    • Reads CPU info

      • SQLSerasi.exe (PID: 6036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:21 07:27:22+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 6
CodeSize: 16384
InitializedDataSize: 389120
UninitializedDataSize: -
EntryPoint: 0x64196
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 7.1.3.1057
ProductVersionNumber: 7.1.3.1057
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
CompanyName: 360.cn
FileDescription: 360安全卫士 LSP修复模块
FileVersion: 7, 1, 3, 1057
InternalName: LSPFix
LegalCopyright: (C) 360.cn All Rights Reserved.
OriginalFileName: LSPFix.EXE
ProductName: 360安全卫士
ProductVersion: 7, 1, 3, 1057
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
9
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start 0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe sqlserasi.exe no specs sqlserasi.exe sqlserasi.exe no specs sqlserasi.exe no specs werfault.exe no specs sppextcomobj.exe no specs slui.exe no specs 0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1300"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe—SQLSerasi.exe
User:
SYSTEM
Company:
360.cn
Integrity Level:
SYSTEM
Description:
360安全卫士 LSP修复模块
Exit code:
0
Version:
7, 1, 3, 1057
Modules
Images
c:\program files (x86)\microsoft sql server\sqlserasi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
2504"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe
services.exe
User:
SYSTEM
Company:
360.cn
Integrity Level:
SYSTEM
Description:
360安全卫士 LSP修复模块
Exit code:
255
Version:
7, 1, 3, 1057
Modules
Images
c:\program files (x86)\microsoft sql server\sqlserasi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
2904"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3888C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4220"C:\Users\admin\AppData\Local\Temp\0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe" C:\Users\admin\AppData\Local\Temp\0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe
explorer.exe
User:
admin
Company:
360.cn
Integrity Level:
HIGH
Description:
360安全卫士 LSP修复模块
Exit code:
0
Version:
7, 1, 3, 1057
Modules
Images
c:\users\admin\appdata\local\temp\0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6036"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe—SQLSerasi.exe
User:
SYSTEM
Company:
360.cn
Integrity Level:
SYSTEM
Description:
360安全卫士 LSP修复模块
Version:
7, 1, 3, 1057
Modules
Images
c:\program files (x86)\microsoft sql server\sqlserasi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
6700"C:\Users\admin\AppData\Local\Temp\0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe" C:\Users\admin\AppData\Local\Temp\0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe—explorer.exe
User:
admin
Company:
360.cn
Integrity Level:
MEDIUM
Description:
360安全卫士 LSP修复模块
Exit code:
3221226540
Version:
7, 1, 3, 1057
Modules
Images
c:\users\admin\appdata\local\temp\0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7036C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2504 -s 708C:\Windows\SysWOW64\WerFault.exe—SQLSerasi.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7148"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe" C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe—0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe
User:
admin
Company:
360.cn
Integrity Level:
HIGH
Description:
360安全卫士 LSP修复模块
Exit code:
0
Version:
7, 1, 3, 1057
Modules
Images
c:\program files (x86)\microsoft sql server\sqlserasi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
2 379
Read events
2 351
Write events
25
Delete events
3

Modification events

(PID) Process:(7148) SQLSerasi.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Microsoft SQL Serverai
Operation:writeName:ConnectGroup
Value:
0827
(PID) Process:(7148) SQLSerasi.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Microsoft SQL Serverai
Operation:writeName:Description
Value:
½ûÖ¹ºó£¬½«ÎÞ·¨Õý³£Ê¹ÓÃSQLÊý¾Ý¿â¡£
(PID) Process:(6036) SQLSerasi.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Microsoft SQL Serverai
Operation:writeName:MarkTime
Value:
2025-04-09 02:15
(PID) Process:(7036) WerFault.exeKey:\REGISTRY\A\{98d9f629-80da-7909-c081-3facb62cc5db}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(7036) WerFault.exeKey:\REGISTRY\A\{98d9f629-80da-7909-c081-3facb62cc5db}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(7036) WerFault.exeKey:\REGISTRY\A\{98d9f629-80da-7909-c081-3facb62cc5db}\Root\InventoryApplicationFile\sqlserasi.exe|7865c15ad72fcd8f
Operation:writeName:ProgramId
Value:
000640ee5e88646c984417b478103c19224d00000408
(PID) Process:(7036) WerFault.exeKey:\REGISTRY\A\{98d9f629-80da-7909-c081-3facb62cc5db}\Root\InventoryApplicationFile\sqlserasi.exe|7865c15ad72fcd8f
Operation:writeName:FileId
Value:
0000e99567086bd0e06e6a69e9c72d569e1e56812729
(PID) Process:(7036) WerFault.exeKey:\REGISTRY\A\{98d9f629-80da-7909-c081-3facb62cc5db}\Root\InventoryApplicationFile\sqlserasi.exe|7865c15ad72fcd8f
Operation:writeName:LowerCaseLongPath
Value:
c:\program files (x86)\microsoft sql server\sqlserasi.exe
(PID) Process:(7036) WerFault.exeKey:\REGISTRY\A\{98d9f629-80da-7909-c081-3facb62cc5db}\Root\InventoryApplicationFile\sqlserasi.exe|7865c15ad72fcd8f
Operation:writeName:LongPathHash
Value:
sqlserasi.exe|7865c15ad72fcd8f
(PID) Process:(7036) WerFault.exeKey:\REGISTRY\A\{98d9f629-80da-7909-c081-3facb62cc5db}\Root\InventoryApplicationFile\sqlserasi.exe|7865c15ad72fcd8f
Operation:writeName:Name
Value:
SQLSerasi.exe
Executable files
1
Suspicious files
4
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7036WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SQLSerasi.exe_5528f7be44915137b41697e1efcd17bbe91aa99_6ea6fe6e_2df9d05c-4796-4d10-8a03-cab6e1c2a1d5\Report.wer —
MD5:—
SHA256:—
7036WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCD83.tmp.dmpbinary
MD5:97F8FA3FAAFBC46FB1501B81B58E61B4
SHA256:47E9726E7165FB51F1FCC5B79E4EE21CF7382D1DE74BF556305068B04E953D02
42200d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exeC:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeexecutable
MD5:8CF28D39933C299F24876252DAF55BAB
SHA256:0D54D32363E61018CFCF27AA874FD0E79B1FEF37C9B7ECA776C7FB7435A2E21D
7036WerFault.exeC:\Windows\appcompat\Programs\Amcache.hvebinary
MD5:8884DA28E3690AA21403BD49F041D075
SHA256:B8AFF9C6B970ACB88AEB2351A117790D05D98CD816709FAA4D00BDAD5B9E04AA
7036WerFault.exeC:\Windows\SysWOW64\config\systemprofile\AppData\Local\CrashDumps\SQLSerasi.exe.2504.dmpbinary
MD5:2FFD9A3CB5CC76590A47C2FD6B5CFF43
SHA256:32185725DAA37D38EC285A9A26C9EC4FE587519CA336870EFA242BFF3F5CADA5
7036WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCE7E.tmp.WERInternalMetadata.xmlbinary
MD5:404CE8ACCC152AFB2A3B5644B85DEAC8
SHA256:A03B0C0C7F9F4B664EAC1685933B49791F4187705FEFBC4507F3083C6572907B
7036WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCEAE.tmp.xmlxml
MD5:F208BDD6320D26CDC00D39462B9BCB43
SHA256:293655DD3BE6E42D23DD59DCC936AA770328390F91E5A2D61B9DB2A2FB23B76C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
19
DNS requests
16
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1616
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1616
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
google.com
  • 172.217.16.206
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
d.nxxxn.ga
  • —
unknown
r.pengyou.com
  • 0.0.0.1
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.2
  • 40.126.31.128
  • 40.126.31.0
  • 20.190.159.130
  • 20.190.159.129
  • 20.190.159.68
  • 20.190.159.73
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO DNS Query for Suspicious .ga Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0d54d32363e61018cfcf27aa874fd0e79b1fef37c9b7eca776c7fb7435a2e21d.exe