45e06dd5d9df8ceab65653a33296f81e97805a58f922bf77cd0055b2d4e166c2

Analysis

max time kernel
145s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:47

Target

Screenshot_15-5-2024_204542_www.youtube.com.jpg
Size

132KB
MD5

43f73fe6d57801b64f5c13b84eaaa44f
SHA1

a5e00dfdfae7e9ac08b2a2d552805b5b51eee21a
SHA256

45e06dd5d9df8ceab65653a33296f81e97805a58f922bf77cd0055b2d4e166c2
SHA512

8dd044cdbe895f1997d193d72591435df92cac7ab5e6ae128ad316d088647ed7c68b7924177d9a5154d2e92017d3d9288a21f1cc635460847a03c71e34fdd8ad
SSDEEP

3072:yRkpj6Hsmk2W8QG6G/KgvKancwVmBs9KcsC0BTt:yCl6MmXW3eygSancTBJtFt

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

2316 rundll32.exe

pid	process
2316	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Screenshot_15-5-2024_204542_www.youtube.com.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2316

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/2316-0-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/2316-1-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download