e20f6cc5622d0ff337a2f87fb5b3f2b7b7aedc4cdd07018c27b38f4cb75b0db8

Analysis

max time kernel
0s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-01-2024 10:53

Target

dionysus-2.0.10/bindings/python/pybind11/tests/test_opaque_types.cpp
Size

2KB
MD5

dc2e3879b506fcaadd2644bfccfe276a
SHA1

6dc8ff53ea4857ffd9c6f4b695fc994c583e2170
SHA256

af034d3a00d482013162de8c6f1c1f44e298aaf1ca78a11b02effbf1ab58b54b
SHA512

ec2d86b8750cb31e8ec2f6a5252071ddb1e3cb2c08113f12572389485bb32a18cd3321a3db23c07e24ae23820ff0846d3bbe9150afb94b1bac2d797dbde16e1e

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2820	1936	cmd.exe	15
PID 1936 wrote to memory of 2820	1936	cmd.exe	15
PID 1936 wrote to memory of 2820	1936	cmd.exe	15

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\dionysus-2.0.10\bindings\python\pybind11\tests\test_opaque_types.cpp
1⤵
PID:2820
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\dionysus-2.0.10\bindings\python\pybind11\tests\test_opaque_types.cpp
  2⤵
  PID:2584

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\dionysus-2.0.10\bindings\python\pybind11\tests\test_opaque_types.cpp
1⤵
- Suspicious use of WriteProcessMemory
PID:1936

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact