31e9f88d2343967251e2ef28dfe51eb901ac91fdea16268f1b023e4d00456e51

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 09:02

Target
data/flutter_assets/packages/fluttericon/lib/fonts/LineariconsFree.ttf
Size 51KB
Sample240510-kzzataea4y
SHA256 2689a9291e616eb9d1847cab91defb69bc45bb6f9a7f033e047641502c22a7fb
MD5 276b1d61e45eb9b2dde9482545d9e3ac
SHA1 3de71092188f50bc456fb9579d7297e03a75340a
SHA512 7a0b8aebd60c181395ced2652b4be3494cf74ffdf7b41e825d29ea43d7fcf9a72efa1c9eb851373622c033d21ec05ab6707104a74f32daf2de9cf042ac87f1f9
SSDEEP 1536:/JCGc5Vsp7Vm738Q78voXqbOPzwGVfmpaInUaJWIA9AlY8dM44Gc+vOx2jOsqq+K:/JpWVsp7cDR8voXqbOPzwGtmpaInUa0s
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2572	1640	cmd.exe	29
PID 1640 wrote to memory of 2572	1640	cmd.exe	29
PID 1640 wrote to memory of 2572	1640	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\packages\fluttericon\lib\fonts\LineariconsFree.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\packages\fluttericon\lib\fonts\LineariconsFree.ttf
  2⤵
  PID:2572

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact