9d8763451c2bd900dbf10e3cdb16132ec706b8e13dbd563aa15835d5b2d8cc4d

Analysis

max time kernel
24s
max time network
20s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 04:06

Target

resources/app/src/assets/icon.ico
Size

11KB
MD5

372b8e595552272d8980d7ce68a22a45
SHA1

3458abecc3172f86c0a42f889402a700964a7bdc
SHA256

9a6b51f26c9efb993a02f67582477d9b524b029af5d6b1bea046840012dc110e
SHA512

bb712405ea0c0ec66add82abd04ca8f32e07bea7e4bbdcb2bce53a16caf8d9bf2a514ec8e647739e739f995931fc6d04d155e8b2f381fb93765024a4aebc1fa4
SSDEEP

192:5oE/UpLYcasZP5WUZ0iClTa8VhjO/wulukJ4M8JQTtDdtEDQ76nE/Vcb8VM8eQvP:j40cNZP5rqiClfhQwuUek6tDEsiockfP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1172 rundll32.exe

pid	process
1172	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\resources\app\src\assets\icon.ico
1⤵
- Suspicious use of FindShellTrayWindow
PID:1172

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1172-0-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1172-1-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download