69937b53c7cbd3067deb7c3a5d83e3af920c216128a4864f0475d81fcffb6c1c | Triage

Analysis

max time kernel
91s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2022 01:11

Sharing

Report Analysis Logs

General

Target

gozi.dll
Size

43KB
MD5

e0d21d314c832d15bcae944e2c2b05cb
SHA1

2e407b8933f7ca1b705ca99eda8dbb2168679aba
SHA256

69937b53c7cbd3067deb7c3a5d83e3af920c216128a4864f0475d81fcffb6c1c
SHA512

d8e8710d1122295ebb6e40adce08c89837a50f11ddf0da38c08361a541b19f802bf6cb2f3bab3612a4379ec8def14c2712126f710798f41d04239ef413a16441
SSDEEP

768:JTmE+L5AkTXKMaqD4leJiArJBFkK527nhoZ3eGiTb7gp6XFlkq9k:JTmE+L5AkTixchBOKinCZ3eGGb7dTR9k

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2096 wrote to memory of 1608	2096	rundll32.exe	rundll32.exe
PID 2096 wrote to memory of 1608	2096	rundll32.exe	rundll32.exe
PID 2096 wrote to memory of 1608	2096	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2096

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
2⤵
PID:1608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1608-132-0x0000000000000000-mapping.dmp

Download