7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/07/2023, 05:47

Target

7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe
Size

106KB
MD5

e98d012c23668413c276433e3792644e
SHA1

ae09cf2a6df73ca5a6d7d5452ff1e4778fa4edf1
SHA256

7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c
SHA512

446203c707f275ccc205767fe0914b9aaf1606322f75f3023d5f531728fc2ce1ba4dd8520308772bbeba08b1a8a3600a5a63b1749b428c3e4ee59227d8c5bd72
SSDEEP

1536:5OYV9aUjJucIQgu1vPIWE+b2SoJX1LNdAWNjtDTGUnqrsw1jQ+hS:8URE+VoJX1LNdVVtOU6sp

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5084	murzuja.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
52	icanhazip.com

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 5084	988	7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe	88
PID 988 wrote to memory of 5084	988	7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe	88
PID 988 wrote to memory of 5084	988	7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe	88

C:\Users\Admin\AppData\Local\Temp\7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe
"C:\Users\Admin\AppData\Local\Temp\7c4bbf42b7f3d9050f5674fd1f222375e63ce95a28536aff074d638e7c308d6c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:988
- C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  2⤵
  - Executes dropped EXE
  PID:5084

C:\Users\Admin\AppData\Local\Temp\murzuja.exe

Filesize
106KB

MD5
cf4e2b5cad2dd066cada338b42f3e539

SHA1
f96f826600170d35e77139392ee9f88553eb4f65

SHA256
4db84f480bbba4cdd4965eeaa15459e2bde4046aad9ff8840a4f347635b4d65c

SHA512
3335bef7e40ac9d5fb09d76de95ef866a6edb8cb895735e380ac54745faf45095103d6dc8a6a3bc06d7335419ea6cc7a340de1e3ea22cb6742a97c718fd2f4b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\murzuja.exe

Filesize
106KB

MD5
cf4e2b5cad2dd066cada338b42f3e539

SHA1
f96f826600170d35e77139392ee9f88553eb4f65

SHA256
4db84f480bbba4cdd4965eeaa15459e2bde4046aad9ff8840a4f347635b4d65c

SHA512
3335bef7e40ac9d5fb09d76de95ef866a6edb8cb895735e380ac54745faf45095103d6dc8a6a3bc06d7335419ea6cc7a340de1e3ea22cb6742a97c718fd2f4b3

Download Submit
memory/988-133-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/988-137-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5084-139-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download