d17e19456065af5ffa92cfe5b41e6dbb9b6d070b68ca33ce6473ed4c13599e0e

Analysis

Target
zloader_1.15.10.0.vir.exe
Size 167KB
Sample200719-carljaxswe
SHA256 d17e19456065af5ffa92cfe5b41e6dbb9b6d070b68ca33ce6473ed4c13599e0e
MD5 53acfcac60b225bf99796213b2fe5e39
SHA1 7b1a535c84e9fb9e6d3f8864d0bfe6d0bab17384
SHA512 2e075b0aa141904690fe82fee45af8d882e09d99aa0b7a478ec4a07e7e257729f77a9172f10313f3a33254e3c7b666b4d6c2926e219999426aed05d3a1858406
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 4064	3768	zloader_1.15.10.0.vir.exe	66
PID 3768 wrote to memory of 4064	3768	zloader_1.15.10.0.vir.exe	66
PID 3768 wrote to memory of 4064	3768	zloader_1.15.10.0.vir.exe	66

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3768	zloader_1.15.10.0.vir.exe
3768	zloader_1.15.10.0.vir.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

C:\Users\Admin\AppData\Local\Temp\zloader_1.15.10.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zloader_1.15.10.0.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:3768
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4064

memory/4064-1-0x0000000000C70000-0x00000000010AF000-memory.dmp

Download

memory/4064-2-0x0000000000C70000-0x00000000010AF000-memory.dmp

Download