ccdec18403c4454e607c277a8280d4a6cbf5534b5d972451f31d7cc62a15ae84 | Triage

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 14:38

Sharing

Report Analysis Logs

General

Target

Ghost[5].cpl
Size

1KB
MD5

7b1ab2c7b5811eebf10c469531bd8248
SHA1

b34e2c7a743ec674a282fe20488e6b08ef6fcdc5
SHA256

85bac8a327249cc9e4e7d49b2a92a115c4b985d2ce8db1f14abb702c59e28ebd
SHA512

7cfd555416cdb9f31580596b088b89e84255e65fe9f9b549556ed34a221dfce24b42c7f80b3f6361faeab3cf50ab58d3b7bc7dccce4220f4cb4968bfb6e940ae

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 900	1416	control.exe	27
PID 1416 wrote to memory of 900	1416	control.exe	27
PID 1416 wrote to memory of 900	1416	control.exe	27

C:\Windows\system32\control.exe
control.exe C:\Users\Admin\AppData\Local\Temp\Ghost[5].cpl
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\Admin\AppData\Local\Temp\Ghost[5].cpl
  2⤵
  PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1416-54-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp

Filesize
8KB

Download