Malware Analysis Report

2025-03-14 22:10

Sample ID 240613-fmg4jsyekl
Target 329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949
SHA256 329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949
Tags
persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949

Threat Level: Shows suspicious behavior

The file 329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949 was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence

Modifies system executable filetype association

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 04:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 04:59

Reported

2024-06-13 05:01

Platform

win7-20240508-en

Max time kernel

149s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
File opened for modification C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
File created C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
File created C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718254756" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718254756" C:\Windows\system\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe

"C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe"

C:\Windows\system\rundll32.exe

C:\Windows\system\rundll32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.zigui.org udp

Files

memory/2188-0-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\SysWOW64\notepad¢¬.exe

MD5 cf405d0690fefeeee25fbf37b3001292
SHA1 134ad685420e5e749b4dc1d7ace27ad71d6ff3b6
SHA256 03646dfd948883327d811f83ee1e9d037b77ffb4b91fe98edc5361652bac7a5c
SHA512 e0d444546f8f5491babf58c44fcf3d5989fe2579c4e64f2de7abae7bc0a79404cef350b58e0346c118084d2410dd94834df24824f1402e6926526d9b8591fa9a

\Windows\system\rundll32.exe

MD5 2b900ad5f7026ea58a56d3737e1e5b81
SHA1 0d8497c8fffabeb40ef5b3ce5903524c9d5af438
SHA256 c6c64cfbb30bd840d12a35fbbbd9edb7d729cec8d8ef96861b322ee5dd4348ff
SHA512 6a7fcf26fa7bd3b211d0026f6ac73963f3ffb655ec700a557544bfb3e949d90a6ffedf4cfec77e82db59e09e59cff8d1c11ff63a4fe4ed0eac6eff20e6254d4c

memory/2188-11-0x00000000002E0000-0x00000000002F6000-memory.dmp

memory/2444-19-0x0000000000400000-0x0000000000415A00-memory.dmp

memory/2188-18-0x00000000002E0000-0x00000000002F6000-memory.dmp

memory/2188-21-0x0000000000400000-0x0000000000415A00-memory.dmp

memory/2188-22-0x00000000002E0000-0x00000000002E2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 04:59

Reported

2024-06-13 05:01

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
File created C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
File created C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
File opened for modification C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718254757" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718254757" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Windows\system\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe

"C:\Users\Admin\AppData\Local\Temp\329535dbf9c8bd64eb6b4a34ef4edc3edc32ad9a0a65392caae7b9783169d949.exe"

C:\Windows\system\rundll32.exe

C:\Windows\system\rundll32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 www.zigui.org udp
HK 103.251.237.123:80 www.zigui.org tcp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/3140-0-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\SysWOW64\notepad¢¬.exe

MD5 aa2a825426e8b83d728f574be809bc96
SHA1 916de2942daf31717d8fc215c0127305e6943164
SHA256 d19d9c76757742d06e1fa4021646fd21667fed17f284266b888354f7fe47dcce
SHA512 a1fe1516794a6d0edae5016a8b01ec7a2028a69b8c6a872320e8a8f13e485f97bce73197df3ae435630776891df042dc3683166402acc1b3e0e5cb4ffa6d6f50

C:\Windows\System\rundll32.exe

MD5 14a1fec475eb1f5c27902f0437e558c1
SHA1 48336001b447208df8135373f9d8fc31e2053e6a
SHA256 33f9977a01777c7bfa8a1a0883b3791c633ce10613a5a2e0cc6e530fab08b43b
SHA512 71782c5c0ad7112d8ca10556c52fd235d8184e282161f3df4711d88ad226ca8579fb55c479cda7d78afa74c5383e91aa8f94403bc11dd1bfba7877f8fdb6f09d

memory/3140-13-0x0000000000400000-0x0000000000415A00-memory.dmp