b2fe49377c9a18bd30d4709499d66bf3d48ff7cb146dcd7b7da6a88fec6c142f

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24/11/2023, 18:51

Target

img_email_drafting.png
Size

2KB
MD5

484795a503ebc558d824cf282bc8602f
SHA1

86a9254927669451c393dd630ad01f283cc79f6d
SHA256

39512aa259888627dd4f9399002ac0712b7f8f5cbbea8ae2d312e450e4464c96
SHA512

1fdb285162ab7291a95336a9bda855ffbb4c4279debeb94f2e0d4ea69679921e73464df458cd4a35cfa320f7dddecdfff5575bf94f1fc2fb0d5f19b958138076

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\img_email_drafting.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2072

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2072-0-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/2072-1-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download