c148c4ae4e093b3653496766f69a01b2fff54fce595836e71373efc8e4ee6794

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-06-2023 18:41

Target

Walkway_Bold.ttf
Size

49KB
MD5

470d92a839dd021b2b1cddcf008f7cbd
SHA1

6c2dc97ce9ae7e401a16294e63fa6fef1d66f91c
SHA256

b1b15ef15bda6cd043a9b161ec07b1416be3e9a3656995a62699c66860de7081
SHA512

5cc5c5541c1b2261bc0c4c63d1cc8a9d12742e7cffad44bdac9673f9d6639b3d7a7f083886aa2f7299a3baed7630d4b3478030b1a0b2387b26d7385e35cd9a0d
SSDEEP

768:4iWKtROR5nGDfmhwAm6l2uFi9CHvdJSG7u9Wb1w9Qkdce6mlu4dB9LtpK2BK+BqE:4XYQR5GfivDSGC9Wb1ZEdB9/K+4E

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 316 wrote to memory of 1168	316	cmd.exe	fontview.exe
PID 316 wrote to memory of 1168	316	cmd.exe	fontview.exe
PID 316 wrote to memory of 1168	316	cmd.exe	fontview.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Walkway_Bold.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\System32\fontview.exe
"C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Walkway_Bold.ttf
2⤵
PID:1168

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact