e105922d77028c891b36eaeda9e536e9bbfbd6de6f78219e49e1d7c83fa67d93 | Triage™

Analysis

max time kernel
136s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
17/03/2022, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gozi.dll
Size 43KB
Sample220317-lnktqabbcp
SHA256 e105922d77028c891b36eaeda9e536e9bbfbd6de6f78219e49e1d7c83fa67d93
MD5 7c30a730ae6a19fd39377ac70dde1aa0
SHA1 63bb79daadf84081827394ab27652436ded7b53e
SHA512 d9366f0d50a3a335e1648811068a639b2e557cbd89e4db6747b35056564ef9228635da0476d549ce752d4be156c4069726ffc0bf3f98b55bae83287fc0e7b24b
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 820	628	rundll32.exe	80
PID 628 wrote to memory of 820	628	rundll32.exe	80
PID 628 wrote to memory of 820	628	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
  2⤵
  PID:820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads