2b5f203f9173f23ad27fb186d24cdfca00d8b886e5376525c0d585eae5753a8b

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 14:05

Target
xylex.exe
Size 10.9MB
Sample240610-rd43haycnd
SHA256 2b5f203f9173f23ad27fb186d24cdfca00d8b886e5376525c0d585eae5753a8b
MD5 17ead4d89ed23763b2492c63facffd83
SHA1 7e24253ae355314029e90bad2f7a7b1fbe1d0e4b
SHA512 f25ea6207d840d5d0c25354cf85cdbcddea424c170ec2079fd0ff58baefee288813e9846a3c2502bd792a8774050e4cb3c4cdfc3b80ebe2fa380cb5f35f928a0
SSDEEP 196608:uhs2i0PA4mtSHeNvX+wfm/pf+xfdkRhZWKsnarIWOzW0DaqhH:IYvtSUvX+9/pWFGRDBsnarIWeRa2H
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2904	xylex.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000017577-46.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2904	836	xylex.exe	28
PID 836 wrote to memory of 2904	836	xylex.exe	28
PID 836 wrote to memory of 2904	836	xylex.exe	28

C:\Users\Admin\AppData\Local\Temp\xylex.exe
"C:\Users\Admin\AppData\Local\Temp\xylex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Users\Admin\AppData\Local\Temp\xylex.exe
  "C:\Users\Admin\AppData\Local\Temp\xylex.exe"
  2⤵
  - Loads dropped DLL
  PID:2904

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\python311.dll
Size 1.6MB
SHA256 b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
MD5 db09c9bbec6134db1766d369c339a0a1
SHA1 c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b
SHA512 653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45
SSDEEP 49152:I0/71KAZkPw/a5lsjIa7hhXBOQSbMS5ffODwKh/Wc:nziPwCvZalhXOMIzQd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2904-48-0x000007FEF5A30000-0x000007FEF6018000-memory.dmp

Download