5da0e0f959a76824ae3c1bb5bdc8bf71c9e5d0fc389f0dc1b9f03cd0bfedca83 | Triage™

Analysis

max time kernel
4294178s
max time network
121s
platform
windows7_x64
resource
win7-20220311-en
submitted
21/03/2022, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gozi.dll
Size 43KB
Sample220321-qk85cscee7
SHA256 5da0e0f959a76824ae3c1bb5bdc8bf71c9e5d0fc389f0dc1b9f03cd0bfedca83
MD5 8855af0d607d754597c6ba1b0cc3708a
SHA1 65dbed522297ac8a50d4393538eea3c51fd7141a
SHA512 56a8f82013377b500863c14bfadcc052027a752f60fd00499559990d83f76a1c1b34e141cd648bef7e0642a87dd7e75e025b933bc4d40e4c4fbfff18152e46de
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 1040	964	rundll32.exe	27
PID 964 wrote to memory of 1040	964	rundll32.exe	27
PID 964 wrote to memory of 1040	964	rundll32.exe	27
PID 964 wrote to memory of 1040	964	rundll32.exe	27
PID 964 wrote to memory of 1040	964	rundll32.exe	27
PID 964 wrote to memory of 1040	964	rundll32.exe	27
PID 964 wrote to memory of 1040	964	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
  2⤵
  PID:1040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-54-0x0000000075E61000-0x0000000075E63000-memory.dmp

Download