31e9f88d2343967251e2ef28dfe51eb901ac91fdea16268f1b023e4d00456e51

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 09:02

Target
data/flutter_assets/packages/fluttericon/lib/fonts/Linecons.ttf
Size 16KB
Sample240510-kzzataea4y
SHA256 84b31ec94d3f119f72780849d89139e6b4fb6894bb89a86d186c10aaf24ab407
MD5 2d0ac407ed11860bf470cb01745fb144
SHA1 36d579e246af42db55df1fe8c48292914414c313
SHA512 963b1b0fffdd4a6a8388b79a1507e42c068798cddc175bacac424763efffac7b65378cddcb9f103fe0b10217ee0a6ea5bacc6de6346000efd20052f3f8f291d0
SSDEEP 384:6km15HnJsmDKhrHKdtp4TvPMCBTdQUg01d8KTgGLpydShvldnu1S0UQjo:6km1rnDSrHKlC16f01lgufAoQM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2492	2772	cmd.exe	29
PID 2772 wrote to memory of 2492	2772	cmd.exe	29
PID 2772 wrote to memory of 2492	2772	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\packages\fluttericon\lib\fonts\Linecons.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\packages\fluttericon\lib\fonts\Linecons.ttf
  2⤵
  PID:2492

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact