875700f34bd5073001e3299df18279e512110068a90e2386dd39152906474bcc

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 23:48

Target

IMG_0199.png
Size

445KB
MD5

496b63d2264a2841d6a521a869d45945
SHA1

559e058bdce0d874eb9487e7fec0b7e8143f192a
SHA256

875700f34bd5073001e3299df18279e512110068a90e2386dd39152906474bcc
SHA512

f9aea9ba1c436701d574d58719787fd1d7c1bf06af8c44230a13cd55f24074b9b9a971cc50ac1f4c901572aaec4965f7e4d27e55996162da13f7f706f1dc5377
SSDEEP

12288:1xm8yyQkcwawrOpXlW2M+ozQOb5LHkfxhugrxl:7DikcwawiXlW2M+E5LH+Pu8X

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\IMG_0199.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2348

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2348-0-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2348-1-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download