Resubmissions

24-01-2025 18:53

250124-xjqd7atrcr 8

24-01-2025 18:37

250124-w9e6gasjcv 8

24-01-2025 18:35

250124-w8hvzatlbm 3

24-01-2025 18:21

250124-wzj2ns1nbs 7

24-01-2025 18:11

250124-wsl8fs1kex 8

24-01-2025 18:05

250124-wpbmjsslgl 7

24-01-2025 17:27

250124-v1e9fa1kbr 8

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24-01-2025 18:53

General

  • Target

    Xeno-v1.1.35-x64/api-ms-win-crt-filesystem-l1-1-0.dll

  • Size

    13KB

  • MD5

    42a2a95f1bb940d01f55eb1674a81fe2

  • SHA1

    f982f3bbb4dc3aaaba8df098d1b395846f7cba08

  • SHA256

    51541ec6684b43157a85ea46a42ebed4555be06bed0d0d07ff3ea6377301318d

  • SHA512

    de9a7a1a6a45e2f76105eaeafcc3c29adbff142dcf2586e147417045b897a9dcddec5e1b97acfc5d3fc9c8e3a508dbc3f607bf3df20a7435e74436f94cb056b6

  • SSDEEP

    192:zt/PGnWlC0i5C9WphWAeD1S8f4DBQABJJ2yy2D8KN3qnajV2MVorr:VunWm5C9WphWbD1IDBRJJkt2lxnorr

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.35-x64\api-ms-win-crt-filesystem-l1-1-0.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3060
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3060 -s 80
      2⤵
        PID:2172

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads