gozi | 36d14824ec9972d04008bae9334463f351332d2634b5b5f3e9f96fb0153a825c

Analysis

max time kernel
95s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 20:01

Target

0443a26389d0d59c77ec5b4a8a641730N.exe
Size

364KB
MD5

0443a26389d0d59c77ec5b4a8a641730
SHA1

4d31fdca748212378a37dd82ae8f0599f5d28d38
SHA256

36d14824ec9972d04008bae9334463f351332d2634b5b5f3e9f96fb0153a825c
SHA512

bdb498db99341c7fe74e8501b8daf9cbd42252a704217a38d2b6e87fab5df92ff912c8c89dd3a319a712a40438052a1a7a7eeb808cdbe266f527ea9afe0de2f7
SSDEEP

1536:+eyRxSzXF8CvrJ4PBhDP3506hBlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:+eWxSh8k6DP3a6hBltOrWKDBr+yJb

Score

10^/10

Family

gozi

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1184 2044 WerFault.exe 0443a26389d0d59c77ec5b4a8a641730N.exe

pid	pid_target	process	target process
1184	2044	WerFault.exe	0443a26389d0d59c77ec5b4a8a641730N.exe

C:\Users\Admin\AppData\Local\Temp\0443a26389d0d59c77ec5b4a8a641730N.exe
"C:\Users\Admin\AppData\Local\Temp\0443a26389d0d59c77ec5b4a8a641730N.exe"
1⤵
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 220
2⤵
- Program crash
PID:1184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2044 -ip 2044
1⤵
PID:3380

memory/2044-0-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2044-1-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download