Malware Analysis Report

2025-08-05 15:54

Sample ID 240529-skxgnsah63
Target b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3
SHA256 b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3
Tags
persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3

Threat Level: Shows suspicious behavior

The file b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3 was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence

Executes dropped EXE

Loads dropped DLL

Modifies system executable filetype association

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-29 15:11

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-29 15:11

Reported

2024-05-29 15:14

Platform

win7-20240508-en

Max time kernel

149s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
File created C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
File opened for modification C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
File opened for modification C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1716995502" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1716995502" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe

"C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe"

C:\Windows\system\rundll32.exe

C:\Windows\system\rundll32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.zigui.org udp
HK 103.251.237.123:80 www.zigui.org tcp

Files

memory/2608-0-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\SysWOW64\notepad¢¬.exe

MD5 dcbebb2e811ae86cbfd669c63a3d2d57
SHA1 961f3a853fdd2a7053399e74163c3697a6d31b33
SHA256 f29b608c6c6b0a0bee415c0af071104ba1f7b672cda9852a0a75b2c951b5ed1d
SHA512 8b753ce64b553c3966d8e4f15a7002612737da47a9d74022693b10894e88811ad379dc361a4c7ed13a198f5b96e660e90b496a1f277161951aacc72f722f5639

memory/2608-12-0x00000000002E0000-0x00000000002F6000-memory.dmp

\Windows\system\rundll32.exe

MD5 5f5cf48876551ffaff525622c9e10988
SHA1 cd61d0d425dda3ba3fc3b3f811abcc11e85b7291
SHA256 06e09d55073abff03676368630a57a72bb093f064b4ceed4a0e4f6f369eae959
SHA512 2df2a68fded477bb23ea082f043e48c565ae20c5f3fc588859e2bb4800d5949b0cac94f39caa8fee5644eed03bbf0f1ab3a239f723e748738aaabc071ff9748c

memory/2356-20-0x0000000000400000-0x0000000000415A00-memory.dmp

memory/2608-19-0x00000000002E0000-0x00000000002F6000-memory.dmp

memory/2608-21-0x0000000000400000-0x0000000000415A00-memory.dmp

memory/2608-22-0x00000000002E0000-0x00000000002E2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-29 15:11

Reported

2024-05-29 15:14

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

96s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
File created C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
File created C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
File created C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1716995502" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1716995502" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe

"C:\Users\Admin\AppData\Local\Temp\b7afb20f3628a9e1670afd0cf423d39e1c2947d8b1872e50521fbdcd6cb718b3.exe"

C:\Windows\system\rundll32.exe

C:\Windows\system\rundll32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.zigui.org udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
HK 103.251.237.123:80 www.zigui.org tcp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 210.131.50.23.in-addr.arpa udp
US 8.8.8.8:53 37.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/1412-0-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\SysWOW64\notepad¢¬.exe

MD5 dcbebb2e811ae86cbfd669c63a3d2d57
SHA1 961f3a853fdd2a7053399e74163c3697a6d31b33
SHA256 f29b608c6c6b0a0bee415c0af071104ba1f7b672cda9852a0a75b2c951b5ed1d
SHA512 8b753ce64b553c3966d8e4f15a7002612737da47a9d74022693b10894e88811ad379dc361a4c7ed13a198f5b96e660e90b496a1f277161951aacc72f722f5639

C:\Windows\system\rundll32.exe

MD5 5f5cf48876551ffaff525622c9e10988
SHA1 cd61d0d425dda3ba3fc3b3f811abcc11e85b7291
SHA256 06e09d55073abff03676368630a57a72bb093f064b4ceed4a0e4f6f369eae959
SHA512 2df2a68fded477bb23ea082f043e48c565ae20c5f3fc588859e2bb4800d5949b0cac94f39caa8fee5644eed03bbf0f1ab3a239f723e748738aaabc071ff9748c

memory/1412-13-0x0000000000400000-0x0000000000415A00-memory.dmp