a3807794c390acc037b4de2d88f9869406ec661946af0a9e4a06cbe1ee0ba4a5

Analysis

max time kernel
28s
max time network
36s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30/06/2023, 18:56

Target

03_dcast_lineup_kai.png
Size

154KB
MD5

144aed3f37a35b5aefdd77656b7c6c5a
SHA1

5f98403bdb2f9f1f9ab3bda1755434410dd5ff6e
SHA256

2b7be90baccf365c26b7b39c9c9d5b29fbd6871d72c28d34f1e8d8410dfc82b8
SHA512

b18e5dbb1afe0c47d42a9d66c52313d1d03c54e2c1fe6746d776ec6dffe1e716cf7a1a17d6ce597d0495e3cf2b18f3efec785f35141bea7118b3f8526940eb09
SSDEEP

3072:WEX2FBvbbUX8blIzbdZsOgk2vGp17EdPmR6TQ9+uBzIBkHTB0wmsuuJKqS:FOrazxFgPv8Y1mP95IBkzB0wmNXqS

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2024	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\03_dcast_lineup_kai.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2024

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2024-54-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2024-55-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download