cdd9a1a5c85ede6c2826689853bfcc59d098a12e414e663ba5e7ab2756f0bd75

Analysis

max time kernel
84s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2023, 09:32

Target
gozi.dll
Size 43KB
Sample230309-lhtvfaaf5t
SHA256 cdd9a1a5c85ede6c2826689853bfcc59d098a12e414e663ba5e7ab2756f0bd75
MD5 bc393fad67c6ce0b59f5a1f336c1c336
SHA1 295fc7424d61cc80bfcf946bab4f9504881cb9c4
SHA512 a2bf4bcd1bfb3a1453a77523aec506b0c102608d468f997236eef17d15406eaa7c37357208240fec7e1089b60d96b46205c530f12c19c6878c3497eb6fe2eef3
SSDEEP 768:E30gsqVXye2rS/Q4VYXQIVpCHlNBmQWGk2j+A6ewBvu7gpzhK3D1GcN:G9sq8S/QEYXQIVWlvmYp6ewNu7hD1Gc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 2248	4448	rundll32.exe	87
PID 4448 wrote to memory of 2248	4448	rundll32.exe	87
PID 4448 wrote to memory of 2248	4448	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
  2⤵
  PID:2248