Analysis

  • max time kernel
    4294179s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    23/03/2022, 05:21

General

  • Target

    gozi.dll

  • Size

    43KB

  • MD5

    d1a3c115a2cee09715572c7ee70451b1

  • SHA1

    44d4963140af2515e2884b3e8077fed446e01438

  • SHA256

    4d34a7f79a78d18656167c38f4fb33d5e9a3e233e84a2238f2d0f6df208b52fa

  • SHA512

    324baffb400377b53893488d1db31f28d4549b6086909e2c8f91010648cd424d7d51db4a78bdfd1286b51978e7b7c603a39828b2036c42c578c984f1f7e89ab5

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:748
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
      2⤵
        PID:784

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/784-55-0x00000000760B1000-0x00000000760B3000-memory.dmp

            Filesize

            8KB