06a191350f2df652d86e6f602638635dfdc621b3677419560bcefd980bb288d7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 20:32

Target

data/flutter_assets/assets/Logo.ico
Size

146KB
MD5

dafe4dfb00de5157a1ad8b8412bf294b
SHA1

42ebc1500e23a8c708246ff0aadb2d8f82f0af0d
SHA256

77df9eb84b8f1a9cecc96a4e07d85e8efd8c8446a949c044f2a1c00adc91e67f
SHA512

47ac4877be1596a1620b959c6608873bd04c41808e82be61c2549c2ff2043928ed6d493acc7af0ce8ebcf283464c1f09b08ff263feb4e435ced6ca6d83262571
SSDEEP

3072:3lPKi7m8KbmdyVLxbaBJe5ZBGhzOj2vGDiH3Mqmy:3lPu8KqdyVL8BJeLB2zOjZmWy

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

2984 rundll32.exe

pid	process
2984	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\assets\Logo.ico
1⤵
- Suspicious use of FindShellTrayWindow
PID:2984

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/2984-0-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download
memory/2984-1-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download