gozi_ifsb | 668ac0ef90e0db8dd33020335f43505d1afce803b7e659d51e3be2bdcc933c5f

Analysis

max time kernel
413s
max time network
417s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 00:07

Target

51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8_unpacked.dll
Size

283KB
MD5

30aea45bf0485a95a8cfa5254aa9e5d5
SHA1

e7e9483142105311a04dacdc19ac10e060735b44
SHA256

668ac0ef90e0db8dd33020335f43505d1afce803b7e659d51e3be2bdcc933c5f
SHA512

3b0e0a3a069af5676e56de0f9b934084290ded4144f7f5ba213d384f531550eb0b67b635f36097b8018d81462f151a827b8325f3edf148a839e0ce031179734b
SSDEEP

6144:09Rv3hOkTHNncBQtfUTqlalxR+u8dsiH6dGKGIyV3EeXiI610zyIckzRiAo:0r5HNtsTqglx5bHdL+39810zyIc5Ao

Score

10^/10

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1044 wrote to memory of 1428	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1428	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1428	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1428	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1428	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1428	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1428	1044	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8_unpacked.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8_unpacked.dll,#1
  2⤵
  PID:1428

memory/1428-54-0x0000000000000000-mapping.dmp

Download
memory/1428-55-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download