448730f2d4964a944073ec33556b6ee092034ad9c2bfc4d1c9ccb2ea5f2fa445

Analysis

Target
zeus 1_1.2.0.5.vir.exe
Size 530KB
Sample200719-w1wpcp9f4n
SHA256 448730f2d4964a944073ec33556b6ee092034ad9c2bfc4d1c9ccb2ea5f2fa445
MD5 afebef98d197bf27d34d40dbfded3acd
SHA1 9d6bcac1a0157f545e4e48640c1be9cad85d859d
SHA512 7b0b544d86ca09e46ffec3cdf2f9f3beef20375d72bc81054deb9c2e4e2ebcb69720a7cca30192c4a55d5c08ac20bea2a878fe06771abaaa0ef95fdb7ba2f6a6
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
832	728	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 832	728	zeus 1_1.2.0.5.vir.exe	24
PID 728 wrote to memory of 832	728	zeus 1_1.2.0.5.vir.exe	24
PID 728 wrote to memory of 832	728	zeus 1_1.2.0.5.vir.exe	24
PID 728 wrote to memory of 832	728	zeus 1_1.2.0.5.vir.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	832	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.0.5.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.0.5.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 96
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:832

memory/832-1-0x0000000001E30000-0x0000000001E41000-memory.dmp

Download

memory/832-2-0x00000000025B0000-0x00000000025C1000-memory.dmp

Download