e175aa6da0bb64b977ecda500ea5b80e4dacd1683317e31261f9583430b25346 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-09-2022 07:24

Sharing

Report Analysis Logs

General

Target

gozi.dll
Size

43KB
MD5

cdefa06087804de576a3139135ad472e
SHA1

032fb489392918aefac4eb0fadda94d596f84d3b
SHA256

e175aa6da0bb64b977ecda500ea5b80e4dacd1683317e31261f9583430b25346
SHA512

811fb187a86e728fab7480adc42c42f36b7bde35f07cb817b51d81d01ffcbf4254f127e6e0bfc282de4caaf70bd0cf775fd73f9a40b2e8276c7045dedc1db831
SSDEEP

768:DibfzHdW3Q0Jfb7cY4ig5sfCQygT8bf1OTNFM7gpt+AFWHuAH:07HdgfncFig5sfCQyXz1OTfM7AYHuA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1972 wrote to memory of 1808	1972	rundll32.exe	28
PID 1972 wrote to memory of 1808	1972	rundll32.exe	28
PID 1972 wrote to memory of 1808	1972	rundll32.exe	28
PID 1972 wrote to memory of 1808	1972	rundll32.exe	28
PID 1972 wrote to memory of 1808	1972	rundll32.exe	28
PID 1972 wrote to memory of 1808	1972	rundll32.exe	28
PID 1972 wrote to memory of 1808	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
  2⤵
  PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-54-0x0000000000000000-mapping.dmp

Download
memory/1808-55-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download