772f18c2bd5370c076786a235f16ea34decfd6bb6352b96df0a6f0ed6ca2a9ca

Analysis

max time kernel
24s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dolphSol-Macro-Amraki-Patch/images/dSM.ico
Size

4KB
MD5

aad5e5e27bdaed9a871059ad02b4857f
SHA1

b1b5372d45aeb1ca98fd433bf0c300829511446a
SHA256

0ec8491078591b7dd11caa81da15f705ec0eb918f61c359fe61e722ee37db49c
SHA512

6807264ab8304225925d79363aa5a4fb468fb3d55444487c33fdc5e45bb5b4c4249f9d21bcfb787ff5f5558bca080d911f6b57398762bf216158ccc52cc74087
SSDEEP

96:68h10A7A3CF+cxj4NoI6inx8e/VT31Ja1TU02fzTnWIrh0u:Hb0S4C4JDn2shlJa1TPwTKu

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\dolphSol-Macro-Amraki-Patch\images\dSM.ico
1⤵
- Suspicious use of FindShellTrayWindow
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3068-0-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/3068-1-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download