a3807794c390acc037b4de2d88f9869406ec661946af0a9e4a06cbe1ee0ba4a5

Analysis

max time kernel
23s
max time network
36s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30/06/2023, 18:56

Target

02_dcast_lineup_noor.png
Size

152KB
MD5

0ccdaf84fe6db25ffdac1a8e2f6ab2a0
SHA1

318996881da404e6eadc35496a1b403b54961bf0
SHA256

fa19f96c2b6dbb392023db00892fbdec7a0aa0c36474d081b5a6f5d0b7574a6b
SHA512

2f6f5b49f15de1810d206dbf92c50b9527ee71f0c9b574a0e7c82975d88c2a942b09a2e21262834212b56cbb4fbb2ed961402aff420e1567d9ac8463a2f76866
SSDEEP

3072:CDAFViSayNlVTt1aCnQGU2bYInKR6LEm9zaSBxiFxvOnehycIoYv1kBHkzNPr:CgVdNlVT/RnQGHbLK4Lh9WJvOeycBwi4

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1260	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\02_dcast_lineup_noor.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1260

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1260-54-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/1260-55-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download