Analysis
-
max time kernel
91s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2022 07:11
Behavioral task
behavioral1
Sample
gozi.dll
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
gozi.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
gozi.dll
-
Size
43KB
-
MD5
605b71e6da7b5b65af32a333116030cc
-
SHA1
9eb51e96356cae7fba3718dbff36b7995522a217
-
SHA256
26bba2cbbd83323d1763975283c238a234c2b9450d03fb2c931b47df7571eac6
-
SHA512
a2d6448d31a4847228650f9310c5f572be4672f269a5ca4d471afc6ea9d79c2032c0d4201ff2e425ec0be7ebea5cf9190046a2f5f394df9fb06fb57a102533d6
-
SSDEEP
768:TTmE+L5AkTXKMaqD4leJiArJBFkK527nhoZ3eGiTb7gp6XFlkq9k:TTmE+L5AkTixchBOKinCZ3eGGb7dTR9k
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4724 wrote to memory of 820 4724 rundll32.exe rundll32.exe PID 4724 wrote to memory of 820 4724 rundll32.exe rundll32.exe PID 4724 wrote to memory of 820 4724 rundll32.exe rundll32.exe