Find similar analyses in TI Lookup
Analysis date (UTC): 1 November 2024, 20:36Analysis environment: Windows 10 Pro, build 19045, x64

dghelp.top

MD5:70895B61B8EDA74930D07612C0AF08B2
SHA1:867D773BCCB16E79E2243993CB36F5FF005B032F
SHA256:9521E4747660A7E70D5935BFFB53060882A745CB0874D6C643E012D0BC3C7228

Analysis result

Threat level:Malicious activity
Tags:
possible-phishingremotescreenconnect
Full analysis:Analysis dghelp.top Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

SCREENCONNECT has been detected (SURICATA)

  • ScreenConnect.ClientService.exe (PID: 5400)

SUSPICIOUS

Possible Social Engineering Attempted

  • svchost.exe (PID: 2172)

Executes as Windows Service

  • ScreenConnect.ClientService.exe (PID: 5400)

Potential Corporate Privacy Violation

  • ScreenConnect.ClientService.exe (PID: 5400)

Executable content was dropped or overwritten

  • dfsvc.exe (PID: 7460)

Connects to unusual port

  • ScreenConnect.ClientService.exe (PID: 5400)

Executes application which crashes

  • support.Client.exe (PID: 6212)

There is functionality for taking screenshot (YARA)

  • ScreenConnect.ClientService.exe (PID: 5400)
  • ScreenConnect.WindowsClient.exe (PID: 6596)

INFO

Executable content was dropped or overwritten

  • msedge.exe (PID: 6316)
  • msedge.exe (PID: 6772)
  • msedge.exe (PID: 6440)

Application launched itself

  • msedge.exe (PID: 2652)
  • msedge.exe (PID: 6316)

Threats

PIDProcessClassMessage
6772msedge.exePotentially Bad TrafficET DNS Query to a *.top domain - Likely Hostile
——Not Suspicious TrafficINFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
——Not Suspicious TrafficINFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
——Not Suspicious TrafficINFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
6772msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
6772msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
6772msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
6772msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
6772msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
6772msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED