Comodo FW green and red bars traffic


English is no my native language

I use sandbox for an application that is a scam or contain viruses. I run it in untrusted level.

So I start application:

svchost.exe. Shows bar color GREEN
untrusted. application Shows bar color RED

Now when its in this status, untrusted application cant do harm at all, Ive already tested long enough

The problem:

RED bar starts to get full, slowly, very slowly, and it ends after 5 or 10 or 15 or 20 minutes.

When gets full, the color bars switch, and now shows like this

untrusted application. Shows bar color GREEN
svchost.exe. Shows bar color RED

When this happen, the untrusted application is able to do harm and damage. If I close the untrusted application and I open it again. It shows the colors bars and order of when is able to do harm and damage.

My question are:

Does anybody knows why this happend?
Does anybody knows how to keep the svchost.exe always in color green? When I do this thing described above.

Any advices…