5e44fa3e9e0279d36a8696c720b6b5a78e6b062ebf3b567e1240020047fa0353

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
28/06/2023, 22:32

Target

MoeWalls/Assets/preview_local.jpg
Size

29KB
MD5

48790131d18691c432e4539da2f75c71
SHA1

58fafa3fc9c94987dd3820889a655001ff6c0932
SHA256

1ed46bb429cc1628a77eb647b4bb073e8e3bb3858b5219e98e58d3924d4ebd4c
SHA512

0afdf2a9e74c1b3bdbcdcb5a0056f3e2d17157b78b682c90989e5077e1f1a748c0dda66456bba29b43a54b37494bad3ebca1280725db88d6d98b006caba31adc
SSDEEP

384:7Z5FfA7YpZ5FwNnuZtYNg70HMAphh3fVnuuIDkuuuGTN9FsDTzMyyysWxxnD:7Z7o78Z7wN2YyMphh9SYBAToyyysgD

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1544	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\MoeWalls\Assets\preview_local.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1544

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1544-54-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1544-55-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download