dfec3a102b5b4419c328857a88bef03b38e371577b276aae00506e69fa108abb

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/01/2023, 13:57

Target

gozi.dll
Size

43KB
MD5

d31858aecf0b618f5485a6e2134d1aa1
SHA1

8df65f3419b6ffaf649bcc63b124d8a71e23567a
SHA256

dfec3a102b5b4419c328857a88bef03b38e371577b276aae00506e69fa108abb
SHA512

1e556b76f22d0a059d515ac584a873baeb5fc4f4715686d5d459dec361512e352e30fac6f906602caf9da3ee1789bbbc0e6597418d82ad01b32ac9e6f0a1f217
SSDEEP

768:iO60dvSXUWzHY4kD/zaho82WVV3rh5Uznoo7e6GzheOB/G7gpdS4JowCyjQBOQ:iOLgy4kD/2H2WjbhcTGNeOdG7uS45QBb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1624	2040	rundll32.exe	28
PID 2040 wrote to memory of 1624	2040	rundll32.exe	28
PID 2040 wrote to memory of 1624	2040	rundll32.exe	28
PID 2040 wrote to memory of 1624	2040	rundll32.exe	28
PID 2040 wrote to memory of 1624	2040	rundll32.exe	28
PID 2040 wrote to memory of 1624	2040	rundll32.exe	28
PID 2040 wrote to memory of 1624	2040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
  2⤵
  PID:1624

memory/1624-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download