7a60171a2366bc7cd2ea97ec50d4d90cf15e8b7c286f3840661aebec9f9b75ef

Analysis

max time kernel
76s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2023, 10:43

Target
20230306_unpacked_gozi.bin.dll
Size 43KB
Sample230306-mr866abh33
SHA256 7a60171a2366bc7cd2ea97ec50d4d90cf15e8b7c286f3840661aebec9f9b75ef
MD5 5b1a2e5c1ad156d5a1179be2af118901
SHA1 6e2d8fb9198b1b03d1edd95b1245bc0aeb1011a7
SHA512 29282cce98c6c3d4d46770bd5dd8e9cdc4da08bd8f6ffd2630f7cd181351accd3847fb2af47816fd535ebb67588f6e4c5f2f5f8088c43165b7196aeafe4e0edf
SSDEEP 768:20gsqVXye2rS/Q4VYXQIVpCHlNBmQWGk2j+A6ewBvu7gpzhK3D1Gc4d:29sq8S/QEYXQIVWlvmYp6ewNu7hD1GcC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 4880	820	rundll32.exe	86
PID 820 wrote to memory of 4880	820	rundll32.exe	86
PID 820 wrote to memory of 4880	820	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\20230306_unpacked_gozi.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\20230306_unpacked_gozi.bin.dll,#1
  2⤵
  PID:4880