f000742f91c25d08477ee7350a252ee79ede94380624086e6fc3dad058244aaa

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09/03/2023, 07:50

Target
gozi.dll
Size 43KB
Sample230309-jpbw4abb97
SHA256 f000742f91c25d08477ee7350a252ee79ede94380624086e6fc3dad058244aaa
MD5 99f3bdae548f13df05abf52fdc664bd6
SHA1 7dbaa568ffecabad7655d559fa29901bd7dae058
SHA512 75a2dcf85d1906d7c4517fec10f9b90bf9442fa57116c81b4d793fbdbda7dd35e3dc5e55e2e4f2fb6a63bca0a9904f59736aa80c1ce22b14142cff7427a5e023
SSDEEP 768:N0gsqVXye2rS/Q4VYXQIVpCHlNBmQWGk2j+A6ewBvu7gpzhK3D1GcP:N9sq8S/QEYXQIVWlvmYp6ewNu7hD1GcP
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1972	2008	rundll32.exe	27
PID 2008 wrote to memory of 1972	2008	rundll32.exe	27
PID 2008 wrote to memory of 1972	2008	rundll32.exe	27
PID 2008 wrote to memory of 1972	2008	rundll32.exe	27
PID 2008 wrote to memory of 1972	2008	rundll32.exe	27
PID 2008 wrote to memory of 1972	2008	rundll32.exe	27
PID 2008 wrote to memory of 1972	2008	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
  2⤵
  PID:1972