1dfcadf8afac3a217d8289f937801c4f85d0855b0697062dbd570eb1c2d1c47c

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 09:06

Target

Xeno-v1.1.3-x64/XenoUI.exe
Size

95KB
MD5

8a0f97c09c4a713e0b2679e90ced44d4
SHA1

e3e06aef78b52e7b764d0e7d8fd906c54c90048c
SHA256

1f041667be5eba5def7efb76d50b9ee4c4988fb8f1e6a1758710b8f73104ba3a
SHA512

06534538d6ba8d8bc8f2528a5bccb8675ee6e65c2f3d79321388c926f926387bdc59b9f247a79f73b804954b2aafeb49b6b53f703bab0a73e573f201ebe5a22d
SSDEEP

1536:ySFCPbkPlSfMuaf1qWR42zxMVY6dTPr7Wa5iiZhOuM/APHV5y6SlSW8fXR:NFWWytdTPr7WAbh7Pby6S+fXR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2732	2644	XenoUI.exe	30
PID 2644 wrote to memory of 2732	2644	XenoUI.exe	30
PID 2644 wrote to memory of 2732	2644	XenoUI.exe	30

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.3-x64\XenoUI.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.3-x64\XenoUI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2644 -s 500
  2⤵
  PID:2732

memory/2644-0-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

Filesize
4KB

Download
memory/2644-1-0x000000013FA50000-0x000000013FA6C000-memory.dmp

Filesize
112KB

Download