812dd59af0fa3be88decd7f9121b9bb2837196a164b40cb61ee29b57b0b759c1 | Triage

Analysis

max time kernel
75s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-09-2022 08:50

Sharing

Report Analysis Logs

General

Target

gozi.dll
Size

43KB
MD5

1b413e1b14b72e4dd7500c21fb6a9476
SHA1

273ab040e4904d016c94de359ae6c723a03ff93e
SHA256

812dd59af0fa3be88decd7f9121b9bb2837196a164b40cb61ee29b57b0b759c1
SHA512

bdf0897ba1c4f53b038c81262a65d57c0d05a5f5fbb7b7175889d6feaa7f597cdb80ac585e109fe0c70f2f4aa8c6d9db0d06c70b36aeb4ff794de04a2bebce2f
SSDEEP

768:ZibfzHdW3Q0Jfb7cY4ig5sfCQygT8bf1OTNFM7gpt+AFWHuA:O7HdgfncFig5sfCQyXz1OTfM7AYHuA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 3920 wrote to memory of 2332	3920	rundll32.exe	84
PID 3920 wrote to memory of 2332	3920	rundll32.exe	84
PID 3920 wrote to memory of 2332	3920	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
  2⤵
  PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-132-0x0000000000000000-mapping.dmp

Download