949c6b5758c2ad61236d73dbbe8dcaba9dc9ee7ff982348551a244990ac8f0b9

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2023, 12:31

Target
extracted_gozi.bin.dll
Size 52KB
Sample230918-pp2emsbf29
SHA256 949c6b5758c2ad61236d73dbbe8dcaba9dc9ee7ff982348551a244990ac8f0b9
MD5 cf3f5be2adee6d87933f972a976222be
SHA1 f6ac2c1b9a6eec087f162e82ab566d2b7502f0e6
SHA512 0e22e07595efd88792e4a319e5f621eb3c5006a52545fd77d8952cb675047b92a38efca3af2e2fc59ef02ff7894bf56f59eadf15f7091da9de9267cb64b7201c
SSDEEP 768:hpspqvzvGcev/I4hCuSHqcTBoBjSVvoraBod/V497PhdMJ7hK3D1GcP:hqpqiv/IoCrntxveRd/V07pdMOD1GcP
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4720	4840	rundll32.exe	84
PID 4840 wrote to memory of 4720	4840	rundll32.exe	84
PID 4840 wrote to memory of 4720	4840	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\extracted_gozi.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\extracted_gozi.bin.dll,#1
  2⤵
  PID:4720