d4ac14a919fad5d81974ff4b683d3ed6b09c8a62b61a92ac30ff4ffeb8eda9dc

Analysis

max time kernel
1565s
max time network
1566s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 03:18

Target

355cc5f31e999404c1829c4ca241f0a8.jpg
Size

15KB
MD5

dc20712258b118bf637bed1477a544fe
SHA1

133984e5d8f5c50d3c5d614488329d66b4cc5869
SHA256

d4ac14a919fad5d81974ff4b683d3ed6b09c8a62b61a92ac30ff4ffeb8eda9dc
SHA512

65e702077b556e4033a183b8c13c91fa4838d49e342e266b0e33195c50a1a7828a42ee862168ef48c77fa2fe1762387f98851bdac7af8ccfb197248ecd2c1520
SSDEEP

384:lgqqQ1XHPjz+YtgxUrR5D7UO6En6xa0VvHE0pQ:mFQFHPjz+YWUrgLEn6x51jpQ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2380	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\355cc5f31e999404c1829c4ca241f0a8.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2380

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2380-0-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download
memory/2380-1-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download