a3807794c390acc037b4de2d88f9869406ec661946af0a9e4a06cbe1ee0ba4a5

Analysis

max time kernel
24s
max time network
33s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30/06/2023, 18:56

Target

05_dcast_lineup_steve.png
Size

149KB
MD5

e715adda1b539a6e6fe5f017e52e61f7
SHA1

08e80ee25ff5c4f5f0d8250d1f3753a797bf18f0
SHA256

60870652cdd2feafd555e3abd8aee964e92376087fc63247aa998cfc7910b5a6
SHA512

9bd3ab90190d8a4892de9d52826f8f4fc617ce0f6ee5c009a4c6e2a00203a7319832cb0afa9a58e1ae49dadb2221aff244364607199b3309994cd026f3bce2d4
SSDEEP

3072:wdlIpbAaZysw2XGCelT7RK86wlZXSquS9SHwBt0Y3Wb/jw2Hx0VbMeL:4apbNr4lTVK86TqjLP0Y3Wb82R0Vx

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1216	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\05_dcast_lineup_steve.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1216

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1216-54-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download
memory/1216-55-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download