31e9f88d2343967251e2ef28dfe51eb901ac91fdea16268f1b023e4d00456e51

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 09:02

Target
data/flutter_assets/packages/fluttericon/lib/fonts/FontAwesome.ttf
Size 154KB
Sample240510-kzzataea4y
SHA256 b8f8327f9f206677b9d0ae9472845f70f4c5bddfb2901c498fe8a4e312f52f9f
MD5 799bb4e5c577847874f20bd0e9b38a9d
SHA1 7e098af59c1cd085de230107e3573313a9c0b7db
SHA512 9f3b8903b97e9b3430717d7c754469cdd9e5f6b0906bead22526da9ca32e6bef6f59e06d7eebe0fd3a1ea8161c417084e57508ca073ac910a108ad4be36fba82
SSDEEP 3072:CH7sM4XCszJk4XLgsH4zZ5iars9taaE5hfynxS6NX1lAR+TmxZFEvmAVb5g/nrrh:CH7wyszJkyLgsH41k6OtFGhfjEXDmxZd
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2536	3016	cmd.exe	29
PID 3016 wrote to memory of 2536	3016	cmd.exe	29
PID 3016 wrote to memory of 2536	3016	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\packages\fluttericon\lib\fonts\FontAwesome.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\packages\fluttericon\lib\fonts\FontAwesome.ttf
  2⤵
  PID:2536

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact