61e1a726a2410e5844398cebe9081f0c564341498a929aab861435fdab5f8157

Analysis

Target
zeus 1_1.2.12.1.vir.exe
Size 127KB
Sample200719-3hal4wbb4s
SHA256 61e1a726a2410e5844398cebe9081f0c564341498a929aab861435fdab5f8157
MD5 7e9eeb9f1d740713b3bbadc323c06532
SHA1 db42047406d66549daa53d727daadf529cfc4a3d
SHA512 41fe84eab539f737c50fee31cb096d1b643ed285076fad8cd6fe4e56c2572ccac7946a8ed01b0d191a3777f6edf21a3f9c2ecf3bc35fd2e914bd666ee08d8245
MD5 SHA1 SHA512

Score

3^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	872	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
872	676	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 872	676	zeus 1_1.2.12.1.vir.exe	24
PID 676 wrote to memory of 872	676	zeus 1_1.2.12.1.vir.exe	24
PID 676 wrote to memory of 872	676	zeus 1_1.2.12.1.vir.exe	24
PID 676 wrote to memory of 872	676	zeus 1_1.2.12.1.vir.exe	24

C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.12.1.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.12.1.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 676 -s 128
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:872

memory/676-0-0x0000000001BA0000-0x0000000001BA1000-memory.dmp

Download

memory/872-2-0x00000000021C0000-0x00000000021D1000-memory.dmp

Download

memory/872-3-0x0000000002590000-0x00000000025A1000-memory.dmp

Download