a2a4f22034f1249eb93a6b14443851040c838aeab36f25dc4c8ae2d8deaba6ab

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 23:13

Target

a2a4f22034f1249eb93a6b14443851040c838aeab36f25dc4c8ae2d8deaba6ab.exe
Size

67KB
MD5

ad41b1788fac93c03099a155e7ce9933
SHA1

5b42f53d7c6e6b71f27828ffde56d3110ebcba5a
SHA256

a2a4f22034f1249eb93a6b14443851040c838aeab36f25dc4c8ae2d8deaba6ab
SHA512

1b77f4e9c30e5d38464f3d0f3369375e57fb400898e01c8d6785c806124a0168e26dec6981b422469f3d85271b95c15429bb96dc4e115ce30eb73ddcb10f7ce9
SSDEEP

1536:9dIERu8ic9Zd8Z3PstS+GccqxGXuqNlqDWhq4eUj9Ww6:9dVS+1xGXuqNl6Wh2UMw6

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1968	murzuja.exe

Loads dropped DLL 1 IoCs

pid	Process
2740	a2a4f22034f1249eb93a6b14443851040c838aeab36f25dc4c8ae2d8deaba6ab.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1968	2740	a2a4f22034f1249eb93a6b14443851040c838aeab36f25dc4c8ae2d8deaba6ab.exe	28
PID 2740 wrote to memory of 1968	2740	a2a4f22034f1249eb93a6b14443851040c838aeab36f25dc4c8ae2d8deaba6ab.exe	28
PID 2740 wrote to memory of 1968	2740	a2a4f22034f1249eb93a6b14443851040c838aeab36f25dc4c8ae2d8deaba6ab.exe	28
PID 2740 wrote to memory of 1968	2740	a2a4f22034f1249eb93a6b14443851040c838aeab36f25dc4c8ae2d8deaba6ab.exe	28

C:\Users\Admin\AppData\Local\Temp\a2a4f22034f1249eb93a6b14443851040c838aeab36f25dc4c8ae2d8deaba6ab.exe
"C:\Users\Admin\AppData\Local\Temp\a2a4f22034f1249eb93a6b14443851040c838aeab36f25dc4c8ae2d8deaba6ab.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  2⤵
  - Executes dropped EXE
  PID:1968

\Users\Admin\AppData\Local\Temp\murzuja.exe

Filesize
67KB

MD5
c0817dfe3428aabf1664aaeb0c918572

SHA1
4b5f8fdca1593f86bf9993f17b0e5d40836949e0

SHA256
b2908afe5543904ac8c20ceee0900f2e5ab4f038a9034921b16e7ea47cd4d2ed

SHA512
77eda4ca3e650b998f56ecbd3849bae20527bdee14063ecee34fb988cc6ea9dd2a038186c657012865f2cd29d9bd9abcd51384d4748b6624a459d39b9579c44f

Download Submit
memory/1968-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2740-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2740-8-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download