7982ef7df2aee22865b90faff6823404718065e2f3560009b7b8b418d72b12d6

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-12-2024 07:31

Target

Xeno.exe
Size

7.0MB
MD5

4cada3a12ec0ee75e590026cadbf82b7
SHA1

9454d5eff1fe850cad41f7074cd88b6afc059f2e
SHA256

7982ef7df2aee22865b90faff6823404718065e2f3560009b7b8b418d72b12d6
SHA512

8b55efd43497a1bf1c6e6db3502c32c8ed278661a8a33d55647fc17ab914a4662bf612b1d13ea932bb3c3f14dcd03ffa14c4a0ae338f83b1644aa193598b2727
SSDEEP

98304:UtevITBg6zamaHl3Ne4i3lqoFhTWrf9eQc0MJYzwZNqkzmas5J1n6ksB0rNHMk:UGIieNlpYfMQc2sEhn6ksqZ

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2416	Xeno.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000600000001748f-21.dat	upx
behavioral1/memory/2416-23-0x000007FEF5680000-0x000007FEF5C69000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2416	2420	Xeno.exe	30
PID 2420 wrote to memory of 2416	2420	Xeno.exe	30
PID 2420 wrote to memory of 2416	2420	Xeno.exe	30

C:\Users\Admin\AppData\Local\Temp\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\Xeno.exe
  "C:\Users\Admin\AppData\Local\Temp\Xeno.exe"
  2⤵
  - Loads dropped DLL
  PID:2416

C:\Users\Admin\AppData\Local\Temp\_MEI24202\python311.dll

Filesize
1.6MB

MD5
64fe8415b07e0d06ce078d34c57a4e63

SHA1
dd327f1a8ca83be584867aee0f25d11bff820a3d

SHA256
5d5161773b5c7cc15bde027eabc1829c9d2d697903234e4dd8f7d1222f5fe931

SHA512
55e84a5c0556dd485e7238a101520df451bb7aab7d709f91fdb0709fad04520e160ae394d79e601726c222c0f87a979d1c482ac84e2b037686cde284a0421c4d

Download Submit
memory/2416-23-0x000007FEF5680000-0x000007FEF5C69000-memory.dmp

Filesize
5.9MB

Download