Analyse mémoire 3/5 - Où est le pansement ?

Description

The process behind the malware appears legitimate. The attacker likely modified it to inject their code and execute their compromise chain. Identify the malicious Thread. From there, find the virtual address of the PTE modified by the attacker.

The flag is in the format FCSC{<thread_id>:<virtual_address>} where:

• <thread_id> is the ID of the malicious Thread (TID), and
• <virtual_address> is the virtual address (within the malicious process context) of the beginning of the modified memory page (PTE).

For example: FCSC{420:0x0022446688aaccee}.

This challenge is part of a serie that should be solved sequentially:

• Analyse mémoire 1/5 - Exfiltration
• Analyse mémoire 2/5 - Origine de la menace
• Analyse mémoire 3/5 - Où est le pansement ?
• Analyse mémoire 4/5 - Un échelon de plus dans la chaîne
• Analyse mémoire 5/5 - Le commencement