b7e59768071d2e1fa278737c39770d2c712cc4c7c9a631c42ae06b7acd4f679a

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 00:49

Target

BE_Import_File-uhd.png
Size

16KB
MD5

4e956224f47e3174c875de22da8b2110
SHA1

34810fe52fcfb9511cf0ddc5e9e016aead8d1e4d
SHA256

301ef2b637e874ed47d6bf34b3755e3de0b8a3642ee43aa9565f7ac57da8d369
SHA512

10c878e474117587e471be38138c2b54eefa202a75620cadcdc7756f1ddea1b1f41add0a03c92503de22f52392eda1a3f7fc74c0f43bdf5e6a5c3e5960882446
SSDEEP

384:5OGRALH6wm5W6BCpCVc7dN5B5297R3cS9:5FO7Dm9BCplzFGRl

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2908	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\BE_Import_File-uhd.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2908

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2908-0-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2908-1-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download