a3807794c390acc037b4de2d88f9869406ec661946af0a9e4a06cbe1ee0ba4a5

Analysis

max time kernel
22s
max time network
35s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30/06/2023, 18:56

Target

06_dcast_lineup_alex.png
Size

152KB
MD5

c664621ad7d6c9069695e36abcd38246
SHA1

47a0fabcff342351c5c928233ecb5f0481dcb5dd
SHA256

0ce1efa0969f6d7d2e296addc250b0f88bbe8a80329dc40551bdb6c7e5fa16bc
SHA512

0efa596b703c48eca2bb19838199ca25a5f7633521b6fa36b9302ed4a6aecac91f545587846f34473f531a120da5db98abcaf52fb0fde3b75f67420962d73f8d
SSDEEP

3072:sOkcJvi6RoMVNSI5IpnTPfaANlOODKHSnQm6dO/nJv2LfFbbsYI:sOk0iZM2I5SnTPnzOHeQm60/nJqftbsF

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2016	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\06_dcast_lineup_alex.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2016

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2016-54-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/2016-55-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download