fe86890c61c00bc5eeeda0d4c9038a432dc99200b8142f65001cc6a0fc730ef2

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 17:01

Target

Outlook-apzs1fye.png
Size

13KB
MD5

1e81fc78ea25caa762b9bb876e78aa9a
SHA1

0b783182cd05955318f4df51fc1be54e8733908f
SHA256

e054606def4d2faa4ff4e9eeb67cae2dfa0c7d00d54c9695f91d19e8802c0d32
SHA512

483a236577fa4862e1d4b24cac548d792f9b97ab6bbb939c3202edc61751ae6a4b3a4f290f0cc132500d176fe4ca8bc4a6a0eea49414e4f0cd7861c9556e382e
SSDEEP

192:Tp1v/+PPrSSnIYnvXzfBoxnBGUYXztavbd82mHkvuIPhCgxZsRKWgQXobnhXGMB3:/vcrSFYvjpodqtObdzJCgARKWgzhXT3

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

2404 rundll32.exe

pid	process
2404	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Outlook-apzs1fye.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2404

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2404-0-0x0000000001E60000-0x0000000001E61000-memory.dmp

Filesize
4KB

Download
memory/2404-1-0x0000000001E60000-0x0000000001E61000-memory.dmp

Filesize
4KB

Download