e8623a8c771bcaa0ccaaae95d4b3723932be3df01887a064609d5a791d7f2134

Analysis

max time kernel
63s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21-01-2025 08:18

Target

Xeno1.exe
Size

7.6MB
MD5

f891caabe2ede658e8dde07871b83434
SHA1

6e076b6ef98f5edd31fa721361ac890a1bba3b8d
SHA256

e8623a8c771bcaa0ccaaae95d4b3723932be3df01887a064609d5a791d7f2134
SHA512

3bdd8c9792548815fa7bd878f0d1ccce820d6ff88fb7e669b1ef9145a51cbd8b349d4c380b76b6c073f807d88da220da1ee3571e5b56876c4afae0b33f582e45
SSDEEP

196608:BVD+kdxwfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWf:35kIHL7HmBYXrYoaUN4

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2972	Xeno1.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a4d3-21.dat	upx
behavioral1/memory/2972-23-0x000007FEF5B40000-0x000007FEF61A5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 2972	1156	Xeno1.exe	30
PID 1156 wrote to memory of 2972	1156	Xeno1.exe	30
PID 1156 wrote to memory of 2972	1156	Xeno1.exe	30

C:\Users\Admin\AppData\Local\Temp\Xeno1.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Users\Admin\AppData\Local\Temp\Xeno1.exe
  "C:\Users\Admin\AppData\Local\Temp\Xeno1.exe"
  2⤵
  - Loads dropped DLL
  PID:2972

C:\Users\Admin\AppData\Local\Temp\_MEI11562\python313.dll

Filesize
1.8MB

MD5
9a3d3ae5745a79d276b05a85aea02549

SHA1
a5e60cac2ca606df4f7646d052a9c0ea813e7636

SHA256
09693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889

SHA512
46840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69

Download Submit
memory/2972-23-0x000007FEF5B40000-0x000007FEF61A5000-memory.dmp

Filesize
6.4MB

Download