da33ab6ea38ec6f285d82061991f014914fe718fe8516c04fa8dc38ea4ddcee2

Analysis

Target
zeus 1_1.2.7.11.vir.exe
Size 408KB
Sample200719-4gq2fe83ve
SHA256 da33ab6ea38ec6f285d82061991f014914fe718fe8516c04fa8dc38ea4ddcee2
MD5 b42fdf91b3cbcca4083c77fdd9dd2ff8
SHA1 ef1c61346a656b4ddfc9ed845387974eff506ab0
SHA512 84b87443865002b5256954716588635cfe730ffd7d52ff9fba0596682bbfc205229e535c1c2509c378db5d4cbf6ae87aa2873f4d14b277a8bab24bd859cd9fb5
MD5 SHA1 SHA512

Score

3^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1184	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1184	1124	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1184	1124	zeus 1_1.2.7.11.vir.exe	24
PID 1124 wrote to memory of 1184	1124	zeus 1_1.2.7.11.vir.exe	24
PID 1124 wrote to memory of 1184	1124	zeus 1_1.2.7.11.vir.exe	24
PID 1124 wrote to memory of 1184	1124	zeus 1_1.2.7.11.vir.exe	24

C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.7.11.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.7.11.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 128
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:1184

memory/1184-1-0x0000000001D70000-0x0000000001D81000-memory.dmp

Download

memory/1184-2-0x00000000024A0000-0x00000000024B1000-memory.dmp

Download