Windows Memory Analysis Report

Introduction

This repository contains the findings from a memory analysis conducted on a Windows 10 system suspected of being compromised. The analysis was performed using Volatility and other forensic tools.

Table of Contents

1. Introduction
2. Process Analysis
3. Suspicious IP Connections
4. Malware Identification
5. Urgent Findings
6. Conclusion
7. Recommendations

Process Analysis

Suspicious IP Connections with Chrome.exe

• 74.125.206.188:5228 (static IP, datacenter)
• 142.251.168.188:5228 (static IP, datacenter)
• 192.229.221.95:80

Chrome.exe VirusTotal Report

Service Analysis

Service VirusTotal Report

Malware Identification

Possibly Malware Found: MFResident.exe

• Hash: 00D4A7FF3FFE03712CF3C62D695D1E19975881313A0E702CB4BB39A112B42E2F
• Path: C:\Program Files (x86)\Common Files\iMyFone\Components\Resident\MFResident.exe
• Installed by: iMyFone

URLs and Details

• https://accountapi.imyfone.com
• UserDetail.json
• /v2/reside-message
• /v2/reside-uninstall-message

MFResident.exe VirusTotal Report

Parent Process

• Parent Process ID: LocalService.exe
• Hash: FDB9FEC2A2809B72C4897955EAA4B960BBC46C183EE15ED706F66DB4E3D46484

Urgent Findings

Volatility Handle Plugin

SearchTextHarvester

 vol -f DESKTOP-C5IQLQB-20240710-110534.dmp windows.handles | grep "SearchTextHarvester"

Conclusion

This memory analysis has revealed several suspicious activities and potential indicators of compromise on the system. The identified suspicious IP connections, potentially malicious files, and other findings warrant further investigation to confirm any malicious intent and to take appropriate remediation actions.