ccdec18403c4454e607c277a8280d4a6cbf5534b5d972451f31d7cc62a15ae84 | Triage

Analysis

max time kernel
214s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 14:38

Sharing

Report Analysis Logs

General

Target

Ghost[4].cpl
Size

3KB
MD5

ac74452ab23f6610beefde30e9f4634d
SHA1

09a8fba437099f044032386e79584ca1358aca6a
SHA256

ff6412040a5a33c486f1bd267281df14f2056931548150b7dfe2564c32c3f264
SHA512

f726aad29358b9c489ae2ec5d0cc8effb2bc6000d0c87e1a197542c0c98104a52e7aaa56b9d514c51996934f2488ce0668372bb9320ac6de1bc8ff2025df6fd6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 872	320	control.exe	27
PID 320 wrote to memory of 872	320	control.exe	27
PID 320 wrote to memory of 872	320	control.exe	27

C:\Windows\system32\control.exe
control.exe C:\Users\Admin\AppData\Local\Temp\Ghost[4].cpl
1⤵
- Suspicious use of WriteProcessMemory
PID:320
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\Admin\AppData\Local\Temp\Ghost[4].cpl
  2⤵
  PID:872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-54-0x000007FEFC311000-0x000007FEFC313000-memory.dmp

Filesize
8KB

Download
memory/872-55-0x0000000000000000-mapping.dmp

Download