ccdec18403c4454e607c277a8280d4a6cbf5534b5d972451f31d7cc62a15ae84 | Triage

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 14:38

Sharing

Report Analysis Logs

General

Target

Ghost[o].cpl
Size

240B
MD5

87a8086bf28a4798f8c65d91955118b3
SHA1

a1254672b43501ac7a4a0ea8c28c5c0d526eaef6
SHA256

ea4b510a07315827703825bfa95a2ec528619a5389f13a138bf5dbf798598da6
SHA512

43691ec4766612cd366a77484e066d50636fd129d29e63207376533cf7de876b7b731a18941079d50260cca93dc50a64ec9cd40d21d5bd2f7f0fcf5451693aa1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1560	1500	control.exe	27
PID 1500 wrote to memory of 1560	1500	control.exe	27
PID 1500 wrote to memory of 1560	1500	control.exe	27

C:\Windows\system32\control.exe
control.exe C:\Users\Admin\AppData\Local\Temp\Ghost[o].cpl
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\Admin\AppData\Local\Temp\Ghost[o].cpl
  2⤵
  PID:1560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1500-54-0x000007FEFB991000-0x000007FEFB993000-memory.dmp

Filesize
8KB

Download