2fa3f17ecf4e81b96837aff155173a34c81f14e16d543237649eaa0885c01f27

Analysis

max time kernel
90s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 16:50

Target

XenoxExploit.exe
Size

7.5MB
MD5

809744fdb0a46e19d8fdb5db88b95a31
SHA1

bc8d73f5aced88732c4d669e87026c7806bce2ca
SHA256

2fa3f17ecf4e81b96837aff155173a34c81f14e16d543237649eaa0885c01f27
SHA512

4a665b44b84cbf2b284d1670d1c54a04bbd7244fce715e4b54b350e9077a5dd974d455775bddfc2e3fbc9e930ba3755c0610e42f4f913d2642a0b324b74b7264
SSDEEP

196608:udQCwV+IurErvI9pWjgN3ZdahF0pbH1AY7WtQsNo/03vC1C:pVRurEUWjqeWx06rYYC

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2820	XenoxExploit.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019c3c-21.dat	upx
behavioral1/memory/2820-23-0x000007FEF5E10000-0x000007FEF64D4000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2820	2296	XenoxExploit.exe	30
PID 2296 wrote to memory of 2820	2296	XenoxExploit.exe	30
PID 2296 wrote to memory of 2820	2296	XenoxExploit.exe	30

C:\Users\Admin\AppData\Local\Temp\XenoxExploit.exe
"C:\Users\Admin\AppData\Local\Temp\XenoxExploit.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\XenoxExploit.exe
  "C:\Users\Admin\AppData\Local\Temp\XenoxExploit.exe"
  2⤵
  - Loads dropped DLL
  PID:2820

C:\Users\Admin\AppData\Local\Temp\_MEI22962\python312.dll

Filesize
1.7MB

MD5
18677d48ba556e529b73d6e60afaf812

SHA1
68f93ed1e3425432ac639a8f0911c144f1d4c986

SHA256
8e2c03e1ee5068c16e61d3037a10371f2e9613221a165150008bef04474a8af8

SHA512
a843ab3a180684c4f5cae0240da19291e7ed9ae675c9356334386397561c527ab728d73767459350fa67624f389411d03665f69637c5f5c268011d1b103d0b02

Download Submit
memory/2820-23-0x000007FEF5E10000-0x000007FEF64D4000-memory.dmp

Filesize
6.8MB

Download