41a9cb804bb9dbf99e70ebaff922e66dee8a4e5dda931831a957061b5d577d80

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 16:13

Target

AdobePIM.dll
Size

2.0MB
MD5

6a4f30d8d98f3e39ce0b9c61dc3512c2
SHA1

9d5c16a963c26a0d480b9f99c95d59476b6121fa
SHA256

41a9cb804bb9dbf99e70ebaff922e66dee8a4e5dda931831a957061b5d577d80
SHA512

433973be1d806ff26e0acf5eb0c0553302a34b03120f70f1f4d9a89d2e08cc70e821abd46ac05cd3026eace53023991d5ab63e777280a2c7bc7d77fc0e641a3d
SSDEEP

49152:Os1FX55XEHlhuO/y0RkHy+O86hihue1HGt4UwU8HS9cC0JCTePkwK/il:Os1KkyVhihue1HGyUwU8Hyo3

Score

4^/10

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\pim.db	rundll32.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\pim.db-journal	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 3408	4212	rundll32.exe	89
PID 4212 wrote to memory of 3408	4212	rundll32.exe	89
PID 4212 wrote to memory of 3408	4212	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AdobePIM.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AdobePIM.dll,#1
  2⤵
  - Drops file in Program Files directory
  PID:3408

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact