949c6b5758c2ad61236d73dbbe8dcaba9dc9ee7ff982348551a244990ac8f0b9

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2023, 12:31

Target

extracted_gozi.bin.dll
Size

52KB
MD5

cf3f5be2adee6d87933f972a976222be
SHA1

f6ac2c1b9a6eec087f162e82ab566d2b7502f0e6
SHA256

949c6b5758c2ad61236d73dbbe8dcaba9dc9ee7ff982348551a244990ac8f0b9
SHA512

0e22e07595efd88792e4a319e5f621eb3c5006a52545fd77d8952cb675047b92a38efca3af2e2fc59ef02ff7894bf56f59eadf15f7091da9de9267cb64b7201c
SSDEEP

768:hpspqvzvGcev/I4hCuSHqcTBoBjSVvoraBod/V497PhdMJ7hK3D1GcP:hqpqiv/IoCrntxveRd/V07pdMOD1GcP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4720	4840	rundll32.exe	84
PID 4840 wrote to memory of 4720	4840	rundll32.exe	84
PID 4840 wrote to memory of 4720	4840	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\extracted_gozi.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\extracted_gozi.bin.dll,#1
  2⤵
  PID:4720