1c4259000aa0a860945f92dd9b8b95ac0a556e1d17ba9d6a237cc4b0fe3f4e31

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 11:11

Target

IMG_0686.png
Size

53KB
MD5

2a4772b05378ce6c3000e9c6cdc47be0
SHA1

6c102c4692874b1c29d8155f47d91335df334d81
SHA256

1c4259000aa0a860945f92dd9b8b95ac0a556e1d17ba9d6a237cc4b0fe3f4e31
SHA512

192de1741329a275d902b471ba315eb3467944735e15628d77dd73ceb4c0be452819084ea4c9cd18801aa02588e219b06838861090f0ffa57baf29b1b39eafae
SSDEEP

1536:aVaQr5FO7L01jbOBsDL0vHjlxkYZSLC4U17LOvLT6C/X:aVafP288L0PhxfZSLC4U1kt

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2340	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\IMG_0686.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2340

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2340-0-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2340-1-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download