cdd9a1a5c85ede6c2826689853bfcc59d098a12e414e663ba5e7ab2756f0bd75 | Triage

Analysis

max time kernel
84s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09-03-2023 09:32

Sharing

Report Analysis Logs

General

Target

gozi.dll
Size

43KB
MD5

bc393fad67c6ce0b59f5a1f336c1c336
SHA1

295fc7424d61cc80bfcf946bab4f9504881cb9c4
SHA256

cdd9a1a5c85ede6c2826689853bfcc59d098a12e414e663ba5e7ab2756f0bd75
SHA512

a2bf4bcd1bfb3a1453a77523aec506b0c102608d468f997236eef17d15406eaa7c37357208240fec7e1089b60d96b46205c530f12c19c6878c3497eb6fe2eef3
SSDEEP

768:E30gsqVXye2rS/Q4VYXQIVpCHlNBmQWGk2j+A6ewBvu7gpzhK3D1GcN:G9sq8S/QEYXQIVWlvmYp6ewNu7hD1Gc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 2248	4448	rundll32.exe	87
PID 4448 wrote to memory of 2248	4448	rundll32.exe	87
PID 4448 wrote to memory of 2248	4448	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
  2⤵
  PID:2248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads