f31c365fedbe1da89d9aebe2d55dfc373170679221724deac12072fa3a013021

Analysis

max time kernel
44s
max time network
16s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 20:46

Target

Whitney-Book-Font.otf
Size

26KB
MD5

7234adf2685474c81e28858c37d40610
SHA1

9b6e4749dcfa702e3fd6cc27d5c2bef1fdb966f9
SHA256

f31c365fedbe1da89d9aebe2d55dfc373170679221724deac12072fa3a013021
SHA512

66e441f0476f65f88d0c9870859f3286c6f1f305c70968555f19f1b1814d2934f6c29a27bf3866ba600e25eee1dcbbfd18739a8750545612caac39ea4e261280
SSDEEP

768:iVkkNqyQDaL+lTYP342SiO3gESn3nRD0fufUTL:i5qy01CyiO3NSn3JPfUT

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1276	1936	cmd.exe	29
PID 1936 wrote to memory of 1276	1936	cmd.exe	29
PID 1936 wrote to memory of 1276	1936	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Whitney-Book-Font.otf
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Whitney-Book-Font.otf
  2⤵
  PID:1276

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact