06a191350f2df652d86e6f602638635dfdc621b3677419560bcefd980bb288d7

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 20:32

Target

data/flutter_assets/assets/Logo.png
Size

369KB
MD5

66b2e231bb458ba990db4264fc33a8a2
SHA1

176089b7928351b306e4f3ffd3f380daebdd77e3
SHA256

f79f963e3252c8955eae8c78d8a2dd082bbb3e4654d464af1124ef40fa5741a6
SHA512

5a9306e0ed1fab63b0a37f62f7baf9ccbd0acb63b97f58d2d9c04c64233acdb020c3364a025ec476c8e06182fcc11d43b89a0127990586c8c53111d5d5c6a07e
SSDEEP

6144:35bzZ54LuEMeSFVqtbNWVoyJAwW+GgKh+7RSphD5TEPiLqsCWDJeJ4+bEmUfoym:ZyQYN5yJsMK8d+1dhCxJ4OEZg1

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1824 rundll32.exe

pid	process
1824	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\assets\Logo.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1824

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/1824-0-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download
memory/1824-1-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download