15f60ddcb36aa4c5d55050587109f3f252e1b61c92744718cd1562181bef97bf

Analysis

max time kernel
70s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 12:25

Target
gozi.dll
Size 43KB
Sample221020-plnpdadeh4
SHA256 15f60ddcb36aa4c5d55050587109f3f252e1b61c92744718cd1562181bef97bf
MD5 a0f63bbf3b8e03bfc7c4941c0bb31075
SHA1 caeb32eb9399e89f166c7e07986c6beb99f3c240
SHA512 6982f0fd8035b53ef71df1efefee2514239447a6236da6abac842bd2a790a20512cbef5e8e072041d2115ce0e23f767545aee0c2b34b2168f5395cdb252650ab
SSDEEP 768:LTmE+L5AkTXKMaqD4leJiArJBFkK527nhoZ3eGiTb7gp6XFlkq9kN:LTmE+L5AkTixchBOKinCZ3eGGb7dTR98
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 2204	452	rundll32.exe	25
PID 452 wrote to memory of 2204	452	rundll32.exe	25
PID 452 wrote to memory of 2204	452	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
  2⤵
  PID:2204