d3baf4f620bd6a65ad0bd17009869a496b7e660d97be21db920daedcf8f95868

Analysis

Target
zeus 1_1.2.4.9.vir.exe
Size 1.5MB
Sample200719-lphtvccftj
SHA256 d3baf4f620bd6a65ad0bd17009869a496b7e660d97be21db920daedcf8f95868
MD5 2d87f01149e5267bde6bdf859e827c7d
SHA1 1ce2413d9cf5bd5b59f39b4cbd49b22654eacd8f
SHA512 22aa96fea1a1ac2b73b1077fbfc31bf29a951c4bab118c1483fbd08805675390c532989d99c78a2304fee55682e777dae5fa1b774885ddaf89c28950c7db57a1
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
736	376	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 736	376	zeus 1_1.2.4.9.vir.exe	24
PID 376 wrote to memory of 736	376	zeus 1_1.2.4.9.vir.exe	24
PID 376 wrote to memory of 736	376	zeus 1_1.2.4.9.vir.exe	24
PID 376 wrote to memory of 736	376	zeus 1_1.2.4.9.vir.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	736	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.4.9.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.4.9.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 128
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:736

memory/736-1-0x00000000020D0000-0x00000000020E1000-memory.dmp

Download

memory/736-2-0x0000000002550000-0x0000000002561000-memory.dmp

Download