34f77c03faaa39e7f7bd7d891c6aa212a16a45ca6a619fd031b0653efeac2ccc

Analysis

max time kernel
117s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 13:43

Target

00595a684f2755c02d9dbb08f4c3110c.png
Size

2KB
MD5

00595a684f2755c02d9dbb08f4c3110c
SHA1

b78babd2132b3bf9569402e5b27b75ca76a4e558
SHA256

fdeacdb20c92e8a2651b9ab6ce22fa1096b149c1abfd0493cad7f4d7e7dc067d
SHA512

1e8f5675bfb2ef15a5a424776ffc3326e0799a940544d969c364d976ab2ad0722182a886591805ae4e33409bd81deb2dbdd7358d5a5b768d5b82b72c1e63d3c5

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\00595a684f2755c02d9dbb08f4c3110c.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1984

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1984-0-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1984-1-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download