Malware Analysis Report

2025-03-14 22:10

Sample ID 240613-e9416avbke
Target 57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb
SHA256 57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb
Tags
persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb

Threat Level: Shows suspicious behavior

The file 57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence

Loads dropped DLL

Executes dropped EXE

Modifies system executable filetype association

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 04:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 04:39

Reported

2024-06-13 04:41

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

96s

Command Line

"C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
File created C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
File created C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
File created C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718253567" C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718253567" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe

"C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe"

C:\Windows\system\rundll32.exe

C:\Windows\system\rundll32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 www.zigui.org udp
HK 103.251.237.123:80 www.zigui.org tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/960-0-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\SysWOW64\notepad¢¬.exe

MD5 b70d9e2d4e2b819f7ead666f383ae114
SHA1 305fd9da538eaf72d6b09e4dead67ef994853b4a
SHA256 d8db2f6ab0d3deb5d60ad82e7cad2732ec3cb9446d126bf4a942b582dd54694c
SHA512 fdbcd47463bbeee282cd2abe3fb74688a3b0ca0b8cdead38f3fdf3383d8e8494836654a5030545e5731cac0ef60f6847ef85c3fd1cd0cb03abdb6b74cc7fd150

C:\Windows\System\rundll32.exe

MD5 a8747311056e7343e048e083726fbc5b
SHA1 0f742bc5f528ddbb5f8773f6297a5d352b3e5c69
SHA256 16c3d64c4fff35f909c3392240464838a380559a6738e09836708b01e8aa81ca
SHA512 60833a2dd7c35cc7672cb8d766ec7cacfd3f2fe1e01903ca4ed6f65ed6c1571c37ca8e30d9ada8b391607d311afbb931c84a430da57d43617e688d6ca7156c53

memory/960-13-0x0000000000400000-0x0000000000415A00-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 04:39

Reported

2024-06-13 04:41

Platform

win7-20240221-en

Max time kernel

149s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
File created C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
File opened for modification C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
File created C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
File created C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718253567" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718253567" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe

"C:\Users\Admin\AppData\Local\Temp\57fddb1bef42e33ccee7e8d36af892b8635900cbd447748f4423ce013cf14fbb.exe"

C:\Windows\system\rundll32.exe

C:\Windows\system\rundll32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.zigui.org udp
HK 103.251.237.123:80 www.zigui.org tcp

Files

memory/112-0-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\SysWOW64\notepad¢¬.exe

MD5 b70d9e2d4e2b819f7ead666f383ae114
SHA1 305fd9da538eaf72d6b09e4dead67ef994853b4a
SHA256 d8db2f6ab0d3deb5d60ad82e7cad2732ec3cb9446d126bf4a942b582dd54694c
SHA512 fdbcd47463bbeee282cd2abe3fb74688a3b0ca0b8cdead38f3fdf3383d8e8494836654a5030545e5731cac0ef60f6847ef85c3fd1cd0cb03abdb6b74cc7fd150

\Windows\system\rundll32.exe

MD5 a8747311056e7343e048e083726fbc5b
SHA1 0f742bc5f528ddbb5f8773f6297a5d352b3e5c69
SHA256 16c3d64c4fff35f909c3392240464838a380559a6738e09836708b01e8aa81ca
SHA512 60833a2dd7c35cc7672cb8d766ec7cacfd3f2fe1e01903ca4ed6f65ed6c1571c37ca8e30d9ada8b391607d311afbb931c84a430da57d43617e688d6ca7156c53

memory/112-12-0x00000000003B0000-0x00000000003C6000-memory.dmp

memory/112-18-0x00000000003B0000-0x00000000003C6000-memory.dmp

memory/112-20-0x0000000000400000-0x0000000000415A00-memory.dmp