26bba2cbbd83323d1763975283c238a234c2b9450d03fb2c931b47df7571eac6 | Triage

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2022 07:11

Sharing

Report Analysis Logs

General

Target

gozi.dll
Size

43KB
MD5

605b71e6da7b5b65af32a333116030cc
SHA1

9eb51e96356cae7fba3718dbff36b7995522a217
SHA256

26bba2cbbd83323d1763975283c238a234c2b9450d03fb2c931b47df7571eac6
SHA512

a2d6448d31a4847228650f9310c5f572be4672f269a5ca4d471afc6ea9d79c2032c0d4201ff2e425ec0be7ebea5cf9190046a2f5f394df9fb06fb57a102533d6
SSDEEP

768:TTmE+L5AkTXKMaqD4leJiArJBFkK527nhoZ3eGiTb7gp6XFlkq9k:TTmE+L5AkTixchBOKinCZ3eGGb7dTR9k

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4724 wrote to memory of 820	4724	rundll32.exe	rundll32.exe
PID 4724 wrote to memory of 820	4724	rundll32.exe	rundll32.exe
PID 4724 wrote to memory of 820	4724	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
  2⤵
  PID:820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/820-132-0x0000000000000000-mapping.dmp

Download