e4308ef8696042985ad5a689efedb5fb4ea2d8ab2b62a4a3455d7613ce9f0d1a

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 00:40

Target

47152e3482c51528c120815123ed93e4.png
Size

4KB
MD5

47152e3482c51528c120815123ed93e4
SHA1

e880b01c57e1bb4e5a3e1fe09daa1a4290418bec
SHA256

e4308ef8696042985ad5a689efedb5fb4ea2d8ab2b62a4a3455d7613ce9f0d1a
SHA512

21f2727a0a3d3b5838b56c825299069ea678e38cd8961ed8b2283f633b4a52eb599b672969ea19c7b4774bb9bf3599fe61dbb1c3021da074ef252110557817f9
SSDEEP

48:VftzLBnl+bwywV/1oZHjnuUQ5D129DzzHOGtbEJUuMeLSeLGeL+te0tlXktwcGyr:ttll+0ZQjWx4JuMjVFJPkNjv

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\47152e3482c51528c120815123ed93e4.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2932

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2932-0-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2932-1-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download