ccdec18403c4454e607c277a8280d4a6cbf5534b5d972451f31d7cc62a15ae84 | Triage

Analysis

max time kernel
232s
max time network
334s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 14:38

Sharing

Report Analysis Logs

General

Target

Ghost[6].cpl
Size

2KB
MD5

ad59a61c38b0213e306189d8089d9c98
SHA1

e024c29a6fae0993aa3bdc6be4609b4101a38824
SHA256

a24f58b1cd249d5c7e8b5dd8c669b4681344325f429d09b6f62d59af722ebd57
SHA512

0a33c6328d54b0fc54724fec537b822e4bdd85db8493f8615336ada31800920542c913aa84422935bbdc4f627cc6500a6d07752a1dc468618a4b3d49cb54407c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 3076	1348	control.exe	80
PID 1348 wrote to memory of 3076	1348	control.exe	80

C:\Windows\system32\control.exe
control.exe C:\Users\Admin\AppData\Local\Temp\Ghost[6].cpl
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\Admin\AppData\Local\Temp\Ghost[6].cpl
  2⤵
  PID:3076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads