Malware Analysis Report

2025-04-14 04:41

Sample ID 240612-3qlx8syhql
Target 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d
SHA256 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d
Tags
persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d

Threat Level: Shows suspicious behavior

The file 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence

Executes dropped EXE

Modifies system executable filetype association

Loads dropped DLL

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-12 23:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 23:43

Reported

2024-06-12 23:45

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
File created C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
File created C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
File created C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718235792" C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718235792" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Windows\system\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe

"C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe"

C:\Windows\system\rundll32.exe

C:\Windows\system\rundll32.exe

Network

Country Destination Domain Proto
US 23.53.113.159:80 tcp
US 8.8.8.8:53 www.zigui.org udp

Files

memory/2620-0-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\SysWOW64\notepad¢¬.exe

MD5 7e97abf4ded003b7ca8c18a218d72ac6
SHA1 b62bb46371ee5f5c55c9384f2ef6bf3ac4ceb869
SHA256 13fc48049c18722a126b5ca44ec76ab528f4c369834e0b371d3e465f7f246f12
SHA512 bbb92b6ef2d63d7fa0198905007d19a98640c3b0cb7ae6bab2ef5e516f56cf6ec4e348e1440826b926fdb70acbe793cf86d06ee0707eb5769babbe3d93443799

C:\Windows\System\rundll32.exe

MD5 5b256c91236dfee07b2259d7187523ed
SHA1 cccf8574049e6d5c29636d06c3e40a854818cdce
SHA256 0d43bcc7afcc07e5606c06e13f5c825c697a5f6014eb9fe781e64f3d55266bab
SHA512 400b5fccbd2b49bc7a9a6cd5daa0f19c3a4f30df68cdbf59322d6e11eed418ee743e83b6f5b64e4c9f617f294f05d26906d36bd36a9f5284b53cc65bbbc3f3d8

memory/2620-13-0x0000000000400000-0x0000000000415A00-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 23:43

Reported

2024-06-12 23:45

Platform

win7-20231129-en

Max time kernel

149s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
File opened for modification C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
File created C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
File created C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718235792" C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718235792" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Windows\system\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe

"C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe"

C:\Windows\system\rundll32.exe

C:\Windows\system\rundll32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.zigui.org udp
HK 103.251.237.123:80 www.zigui.org tcp

Files

memory/1392-0-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\SysWOW64\notepad¢¬.exe

MD5 7e97abf4ded003b7ca8c18a218d72ac6
SHA1 b62bb46371ee5f5c55c9384f2ef6bf3ac4ceb869
SHA256 13fc48049c18722a126b5ca44ec76ab528f4c369834e0b371d3e465f7f246f12
SHA512 bbb92b6ef2d63d7fa0198905007d19a98640c3b0cb7ae6bab2ef5e516f56cf6ec4e348e1440826b926fdb70acbe793cf86d06ee0707eb5769babbe3d93443799

\Windows\system\rundll32.exe

MD5 5b256c91236dfee07b2259d7187523ed
SHA1 cccf8574049e6d5c29636d06c3e40a854818cdce
SHA256 0d43bcc7afcc07e5606c06e13f5c825c697a5f6014eb9fe781e64f3d55266bab
SHA512 400b5fccbd2b49bc7a9a6cd5daa0f19c3a4f30df68cdbf59322d6e11eed418ee743e83b6f5b64e4c9f617f294f05d26906d36bd36a9f5284b53cc65bbbc3f3d8

memory/1392-18-0x0000000000260000-0x0000000000276000-memory.dmp

memory/1392-17-0x0000000000260000-0x0000000000276000-memory.dmp

memory/1392-20-0x0000000000400000-0x0000000000415A00-memory.dmp

memory/1392-21-0x0000000000260000-0x0000000000262000-memory.dmp