5c3a98757492f66858c778197273a6fd4cf3e8f54c3dd5c4254b4fc43b4289a0

Analysis

max time kernel
119s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2022, 13:57

Target
gozi.dll
Size 43KB
Sample220920-q9ebaadbb9
SHA256 5c3a98757492f66858c778197273a6fd4cf3e8f54c3dd5c4254b4fc43b4289a0
MD5 c0fb5ae2613005dbdffdf4cbd66d9304
SHA1 cf63a0f5a34b43a33f4411026e5ba9998423eb6a
SHA512 ca614f50f67d70570ec19932cc5eaa509cf778741bd4c74d680c5239618cf47bc32cadd00b731549bc1780cec9783ec6ad7679e993422fd380683d0131e9d76b
SSDEEP 768:klYhzJ2VQEFfLCUeQCuu6Mf39Y+RMRZOz4yM7gp/6lvVpG:klYhzJ2VQEFf/2VYuAZOzNM7uyHG
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4820	4860	rundll32.exe	82
PID 4860 wrote to memory of 4820	4860	rundll32.exe	82
PID 4860 wrote to memory of 4820	4860	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
  2⤵
  PID:4820