Analyse mémoire 2/5 - Origine de la menace

Description

There is indeed an active malware on the machine. We would like to understand how the attacker was able to execute it in memory. Identify the process that allowed the malware to be executed.

The flag is in the format FCSC{<process_name>:<process_id>} where:

• <process_name> is the name of the process responsible for launching the malware, and
• <process_id> is the Process ID (PID) of the process responsible for launching the malware.

For example: FCSC{malware.exe:42}.

This challenge is part of a serie that should be solved sequentially:

• Analyse mémoire 1/5 - Exfiltration
• Analyse mémoire 2/5 - Origine de la menace
• Analyse mémoire 3/5 - Où est le pansement ?
• Analyse mémoire 4/5 - Un échelon de plus dans la chaîne
• Analyse mémoire 5/5 - Le commencement