97590e4683abd8a7c02dfd85961e78d4ce592dec814b5babd78d123f25396631 | Triage

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 13:27

Sharing

Report Analysis Logs

General

Target

gozi.dll
Size

44KB
MD5

0d46673d3743117f0a93ddc51c54c90b
SHA1

7dbef61871d78b6d3cdd7960f284860ef87ef025
SHA256

97590e4683abd8a7c02dfd85961e78d4ce592dec814b5babd78d123f25396631
SHA512

0fc1f7719f11d105b12f985ed528dd7722a48858d0a883a45000b94401e3d4b72457ec91b207cec1f6da070231fb96449e24adb1040b9c6a1b0f9d8a2c7b39cf
SSDEEP

768:WX/rx/qCa8OmwxfhqwSJ9z7XdjP0lBdCEtDsh4eLiTL7gpP1ZXOTy:Wvrx/qp8OmwxfhyVxQlBdvW4eLOL7eX7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1168 wrote to memory of 2304	1168	rundll32.exe	rundll32.exe
PID 1168 wrote to memory of 2304	1168	rundll32.exe	rundll32.exe
PID 1168 wrote to memory of 2304	1168	rundll32.exe	rundll32.exe
PID 1168 wrote to memory of 2304	1168	rundll32.exe	rundll32.exe
PID 1168 wrote to memory of 2304	1168	rundll32.exe	rundll32.exe
PID 1168 wrote to memory of 2304	1168	rundll32.exe	rundll32.exe
PID 1168 wrote to memory of 2304	1168	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
  2⤵
  PID:2304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads