9c01cf666c922c17867f4d2a85d090376c6f82e2c77b16de330d116f147fca59

Analysis

Target
zeus 1_1.2.3.1.vir.exe
Size 532KB
Sample200719-dpg8e5dx7n
SHA256 9c01cf666c922c17867f4d2a85d090376c6f82e2c77b16de330d116f147fca59
MD5 0797dda9930e3b0a7345984d4fbb9509
SHA1 6c21660acf1c1af1eae98aececa607bed5305fe0
SHA512 b12cede9810d8176706ae9f089176d16bfaadad3e5b01087629cc3d1f3374a72b7bb12cae12cf909d5ea892eab41e16ed95d3351f07ed3acfde8de30318caada
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1108	1104	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1108	1104	zeus 1_1.2.3.1.vir.exe	24
PID 1104 wrote to memory of 1108	1104	zeus 1_1.2.3.1.vir.exe	24
PID 1104 wrote to memory of 1108	1104	zeus 1_1.2.3.1.vir.exe	24
PID 1104 wrote to memory of 1108	1104	zeus 1_1.2.3.1.vir.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.3.1.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.3.1.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 96
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1108

memory/1108-1-0x0000000002120000-0x0000000002131000-memory.dmp

Download

memory/1108-2-0x0000000002580000-0x0000000002591000-memory.dmp

Download