01917eb065381a2bd3e0a037b40b488c47f7abf9158db5fd829fd5738bba8595

Analysis

Target
zeus 1_1.2.7.8.vir.exe
Size 161KB
Sample200719-9f4m5v3jdn
SHA256 01917eb065381a2bd3e0a037b40b488c47f7abf9158db5fd829fd5738bba8595
MD5 9c782133fc740af82359cea11c311cac
SHA1 6858b35fb3f5a6d49beab09c93bdc5bf189ba142
SHA512 0ca00091c0aeb25b0321db8321f57c395cb39483ad25f940005fa32f486257def1405920918bb9f2454f1b4500dd25de129db9aae1aa713afa166051a188d6f9
MD5 SHA1 SHA512

Score

3^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1064	1060	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 1064	1060	zeus 1_1.2.7.8.vir.exe	24
PID 1060 wrote to memory of 1064	1060	zeus 1_1.2.7.8.vir.exe	24
PID 1060 wrote to memory of 1064	1060	zeus 1_1.2.7.8.vir.exe	24
PID 1060 wrote to memory of 1064	1060	zeus 1_1.2.7.8.vir.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.7.8.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.7.8.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 128
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1064

memory/1064-1-0x0000000001F70000-0x0000000001F81000-memory.dmp

Download

memory/1064-2-0x00000000024D0000-0x00000000024E1000-memory.dmp

Download