7ff6f9e74cfb20dc94e9411e75ed1517c95eecb7633ebcb97d8b90ba789bbfa5

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-01-2025 20:20

Target

XenoPatch.exe
Size

7.5MB
MD5

3ea0aeead230da875bedd31537fcbc62
SHA1

c260e354d3a8ffeeeb6afb0b126c7940f87d10b6
SHA256

7ff6f9e74cfb20dc94e9411e75ed1517c95eecb7633ebcb97d8b90ba789bbfa5
SHA512

c4b4813075360dea0bf470fc0aef02c83e5b4dffac0b2a26e18a7732557f32f0e05f6d21dba76494e56de91ca7d1548fb7f07a761450bf91cdb9bf31c34ef380
SSDEEP

196608:2CgFI3wfI9jUC2gYBYv3vbWY+iITm1U6fd1EI:OFxIH2gYBgDW/TOzb/

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2872	XenoPatch.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019515-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2872	2736	XenoPatch.exe	30
PID 2736 wrote to memory of 2872	2736	XenoPatch.exe	30
PID 2736 wrote to memory of 2872	2736	XenoPatch.exe	30

C:\Users\Admin\AppData\Local\Temp\XenoPatch.exe
"C:\Users\Admin\AppData\Local\Temp\XenoPatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Local\Temp\XenoPatch.exe
  "C:\Users\Admin\AppData\Local\Temp\XenoPatch.exe"
  2⤵
  - Loads dropped DLL
  PID:2872

C:\Users\Admin\AppData\Local\Temp\_MEI27362\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2872-23-0x000007FEF61D0000-0x000007FEF6895000-memory.dmp

Filesize
6.8MB

Download