058fe55bd0d660b35e7d4d3567817625973c54ad4f0895d99ec6d0efa043c4e6

Analysis

max time kernel
26s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
10/07/2023, 14:45

Target

image0.jpeg
Size

190KB
MD5

6f428f4caa61e369a52e1cda25046559
SHA1

7bf9d9b688683c456026d9ca018375e0af6343cf
SHA256

058fe55bd0d660b35e7d4d3567817625973c54ad4f0895d99ec6d0efa043c4e6
SHA512

636b0f13a0ab5d97dc888fe869c8217a37191e6a28d3aed42f8b627c5cea14860e19db70270761d8742db5ddc49437f3d1c116efdc7240b6011966c5eb311ef8
SSDEEP

3072:LrL44rjvK3U/l3hVr6SlGvx96aZt/ByeWLXYZfKeHqsLJWfc2kZxbUhoIG36:Lf44rjvKg3b6Sl+P7L0LOKsVPzbUqIGq

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2824	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\image0.jpeg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2824

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2824-54-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download