ba1a5cd9f9c292c667a0d4d577cf66afe813b9fa838752c67ea6363e5b36c841

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20/03/2023, 10:43

Target
gozi.dll
Size 43KB
Sample230320-msrnhafa5w
SHA256 ba1a5cd9f9c292c667a0d4d577cf66afe813b9fa838752c67ea6363e5b36c841
MD5 90b6cdfe9896972ccee348859f8e173d
SHA1 53bce0dabc905d8aa32c9aacfdbf74bf705c8946
SHA512 e53758d6dc44de19a76b056cd141155920c56070e6a120eea5f8b8411a829ff37391fb8a0a411185354d828e6758fdbe87ab5f1b84520f038c4b85e8d8eaab68
SSDEEP 768:s0gsqVXye2rS/Q4VYXQIVpCHlNBmQWGk2j+A6ewBvu7gpzhK3D1GcQh:s9sq8S/QEYXQIVWlvmYp6ewNu7hD1GcQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1928	1988	rundll32.exe	28
PID 1988 wrote to memory of 1928	1988	rundll32.exe	28
PID 1988 wrote to memory of 1928	1988	rundll32.exe	28
PID 1988 wrote to memory of 1928	1988	rundll32.exe	28
PID 1988 wrote to memory of 1928	1988	rundll32.exe	28
PID 1988 wrote to memory of 1928	1988	rundll32.exe	28
PID 1988 wrote to memory of 1928	1988	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gozi.dll,#1
  2⤵
  PID:1928