4dd191ca0a4057956c09e115e686a75eba6088cc7625cb9beb82a243f5c852ad | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 08:55

Sharing

Report Analysis Logs

General

Target

gozi.dll
Size

44KB
MD5

72ae8ea863e8b4786b520794f00bf083
SHA1

edbc7be3475549ad482c0ce227e6af512872b6e9
SHA256

4dd191ca0a4057956c09e115e686a75eba6088cc7625cb9beb82a243f5c852ad
SHA512

afbffedbc38493c5fe2f713786af91ba7d12737c88b0453a24ba2df3761af454d0a7351ffeed3ebafe9ce80dbef206de5474b6a545a115f3914138a4db9d584e
SSDEEP

768:/X/rx/qCa8OmwxfhqwSJ9z7XdjP0lBdCEtDsh4eLiTL7gpP1ZXOTyUP:/vrx/qp8OmwxfhyVxQlBdvW4eLOL7eXa

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2964 wrote to memory of 2980	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 2980	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 2980	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 2980	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 2980	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 2980	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 2980	2964	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
2⤵
PID:2980

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...