875655906f4b3f03040c9137a6e772418558c210a036c9e28e0873e3bd467eec

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
17-10-2023 15:30

Target

Asap-MediumItalic.ttf
Size

88KB
MD5

5e7aaa344ddf8684dd2f4cb144ac5cd5
SHA1

996d067387317fe462ca2c7b5c892b2b4fa1f0ad
SHA256

d92eb524b54ff77b55b641f2b47d6fabb4662075ec4abc6b6e1efebeb79c0397
SHA512

259c446d4738046d245c65d3d1c67b27d16b6199a16a1fec651227e410efc8480ca7ea60ea8ed17bfd87c945ba5e706b068557a98fca0eb2d7ceaf197dc2c476
SSDEEP

1536:7EwmDsFBNpwyKbvNnxE042i4Tg0D0kiudUXeQIby2uLjDEqUPY+B3hgIcBCO8yJa:+nxEsVUO8E1h2CO8yE

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2088 wrote to memory of 2768	2088	cmd.exe	fontview.exe
PID 2088 wrote to memory of 2768	2088	cmd.exe	fontview.exe
PID 2088 wrote to memory of 2768	2088	cmd.exe	fontview.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Asap-MediumItalic.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\System32\fontview.exe
"C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Asap-MediumItalic.ttf
2⤵
PID:2768

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance