ccdec18403c4454e607c277a8280d4a6cbf5534b5d972451f31d7cc62a15ae84 | Triage

Analysis

max time kernel
169s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 14:38

Sharing

Report Analysis Logs

General

Target

Ghost[o].cpl
Size

240B
MD5

87a8086bf28a4798f8c65d91955118b3
SHA1

a1254672b43501ac7a4a0ea8c28c5c0d526eaef6
SHA256

ea4b510a07315827703825bfa95a2ec528619a5389f13a138bf5dbf798598da6
SHA512

43691ec4766612cd366a77484e066d50636fd129d29e63207376533cf7de876b7b731a18941079d50260cca93dc50a64ec9cd40d21d5bd2f7f0fcf5451693aa1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 4184	4684	control.exe	81
PID 4684 wrote to memory of 4184	4684	control.exe	81

C:\Windows\system32\control.exe
control.exe C:\Users\Admin\AppData\Local\Temp\Ghost[o].cpl
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\Admin\AppData\Local\Temp\Ghost[o].cpl
  2⤵
  PID:4184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads