075cc243d516902fd0b97c31889291526224f3aa9a589e13b55bde9a0f9e832d

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 14:39

Target

ImageOptions_logo_34cdbb91-b0bc-44e1-bf7b-db20de8de3bd.png
Size

7KB
MD5

9b3aea8e9f19a07dd0024ebdbe0caaf7
SHA1

b5b7e5fb516102cf6d179fd8f916ee799d14d820
SHA256

ea111c99114e39a5180e6268140af0a038185b91082a2f6574882eb39c8e7ae1
SHA512

782f3c24051fd1efd966fbd9e5d1f669f928212582f767a2edf2e5406d6893eec9690a09df871f6ac458dc44986e4dbe5686d480e976e56a011e9aee8b6345c2
SSDEEP

96:VSzajezYIfFg5wK14zQJViqUfKM8RCwSL9oCp7h2GUi6Qg2H+sEGP9fvbzQYk81+:VSHqd1esijn7oiysHRhvvs8N/oV

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2216	rundll32.exe
2216	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\ImageOptions_logo_34cdbb91-b0bc-44e1-bf7b-db20de8de3bd.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2216

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2216-0-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download