97590e4683abd8a7c02dfd85961e78d4ce592dec814b5babd78d123f25396631 | Triage

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 13:27

Sharing

Report Analysis Logs

General

Target

gozi.dll
Size

44KB
MD5

0d46673d3743117f0a93ddc51c54c90b
SHA1

7dbef61871d78b6d3cdd7960f284860ef87ef025
SHA256

97590e4683abd8a7c02dfd85961e78d4ce592dec814b5babd78d123f25396631
SHA512

0fc1f7719f11d105b12f985ed528dd7722a48858d0a883a45000b94401e3d4b72457ec91b207cec1f6da070231fb96449e24adb1040b9c6a1b0f9d8a2c7b39cf
SSDEEP

768:WX/rx/qCa8OmwxfhqwSJ9z7XdjP0lBdCEtDsh4eLiTL7gpP1ZXOTy:Wvrx/qp8OmwxfhyVxQlBdvW4eLOL7eX7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1528 wrote to memory of 2640	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 2640	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 2640	1528	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
2⤵
PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...