995974b2833aea2494086e73394ff8f68d9caf17a15cb19ab3b44cf56c30d324

Analysis

max time kernel
359s
max time network
363s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 16:58

Target

Xylex_Executor.exe
Size

17.0MB
MD5

c603fe7627aea197d40071d4b108d7ab
SHA1

f92863306d69d5eed65f1cbbf0dc9dbe2e3bdbc9
SHA256

995974b2833aea2494086e73394ff8f68d9caf17a15cb19ab3b44cf56c30d324
SHA512

7403ff5c53a64fe05bbd1c1e6051d12a6fd73f050cf18056aa5215851f55ab05d1e475d775c784828c7f35ba80be455a3978bf99815fc881cdfc0d06fd153f65
SSDEEP

393216:aE6QdqiXJWQsUcR4NzBdQJlewF3MnG3xl5gu3jBsn9e8WdaMU0i5VjwIH:aE6qXXYQF5dQT3MGxguVGjBCWjF

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2380	Xylex_Executor.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2380	2280	Xylex_Executor.exe	28
PID 2280 wrote to memory of 2380	2280	Xylex_Executor.exe	28
PID 2280 wrote to memory of 2380	2280	Xylex_Executor.exe	28

C:\Users\Admin\AppData\Local\Temp\Xylex_Executor.exe
"C:\Users\Admin\AppData\Local\Temp\Xylex_Executor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\Xylex_Executor.exe
  "C:\Users\Admin\AppData\Local\Temp\Xylex_Executor.exe"
  2⤵
  - Loads dropped DLL
  PID:2380

C:\Users\Admin\AppData\Local\Temp\_MEI22802\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit