Malware Analysis Report

2025-04-14 01:40

Sample ID 240602-2f8tkshd8t
Target 6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642
SHA256 6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642
Tags
persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642

Threat Level: Shows suspicious behavior

The file 6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642 was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence

Executes dropped EXE

Loads dropped DLL

Modifies system executable filetype association

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-02 22:32

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-02 22:32

Reported

2024-06-02 22:35

Platform

win7-20240220-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
File created C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
File created C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
File created C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1717367560" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1717367560" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Windows\system\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe

"C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe"

C:\Windows\system\rundll32.exe

C:\Windows\system\rundll32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.zigui.org udp
HK 103.251.237.123:80 www.zigui.org tcp

Files

memory/2008-0-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\SysWOW64\notepad¢¬.exe

MD5 dd2c666187cb25a1fd0fb5c34412f415
SHA1 7944b88a2786dbd70313f26644a1905c926ef4e0
SHA256 4a67ff7235472dd5b49f99bccf351b26de71fb06b7b929f187f68b660db6081a
SHA512 ecebcc4b40effc6a245996d9af57b2bb016b7b1f6ed09b75c6b4bfa251f9e92a040536ce8d28d50f1b6e5cfd672ffea8290980a1395447da0c7ddf20970f111e

C:\Windows\system\rundll32.exe

MD5 9256470542a1ae914d6bfb35e983e28e
SHA1 5940f0ac650a2a5ffb35748a3457ab107fed15c6
SHA256 d79492703b4ec87f22e7b4c992473a790d04d91b3118dbe0b4d00429c2024315
SHA512 dce64a0847b81668a256ac67d1694a0e4b740a3faef34ac9e3bf62a27a3006a3fbec635d4367398c1dc4e466e2a0543b01e17304cb455937e0cd24379b4c6947

memory/2008-18-0x00000000002E0000-0x00000000002F6000-memory.dmp

memory/2008-17-0x00000000002E0000-0x00000000002F6000-memory.dmp

memory/2008-21-0x00000000002E0000-0x00000000002E2000-memory.dmp

memory/2008-20-0x0000000000400000-0x0000000000415A00-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-02 22:32

Reported

2024-06-02 22:35

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
File created C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
File opened for modification C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
File created C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1717367562" C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1717367562" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe

"C:\Users\Admin\AppData\Local\Temp\6ee53e8b245cd48f5e22132468d833ab557c42b0cda11cf0050e7f71901a1642.exe"

C:\Windows\system\rundll32.exe

C:\Windows\system\rundll32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.zigui.org udp
HK 103.251.237.123:80 www.zigui.org tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 130.211.222.173.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

memory/4888-0-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\SysWOW64\notepad¢¬.exe

MD5 d43263b4a7d7ab3d87ca02eaa2bc9274
SHA1 b80bf329c6788f3dd8c8c0ecda150cbe2cf5a7dd
SHA256 5033a78c84818bb32fc863f5bc826cee2b3f9269400c8a56d03a1750a20a500f
SHA512 2c56f045253888faf220889c600afbb8249ddd06e171c84d2044f49c0f6a59d2ce962dd6cdd9261ca49cef3ed83aa23a3e9d21f25e40e38b455dc82352fd1780

C:\Windows\System\rundll32.exe

MD5 f7d96d70c88809954ddf238eba2fa33a
SHA1 4d9105a01b5691828cb541a68398913dea28ae90
SHA256 105d103b9e8215a5984a3670e2dadee1cc9343b95308714cf557746b41c3055b
SHA512 0fef771b5e41263367d05ab90766926eaa80ea8ddda8801af5b3eef3d95d4ae83ec11a3926281cd44e503700df24914ac524ed7a1834112558efa6170bff7154

memory/4888-13-0x0000000000400000-0x0000000000415A00-memory.dmp