80c4016577c11791f64e2d43e1dfad2b01adf7276100400a4421b48df6e6fbfe

Resubmissions

29/01/2025, 08:13

29/01/2025, 08:08

29/01/2025, 08:01

29/01/2025, 07:41

max time kernel
493s
max time network
553s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250128-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
29/01/2025, 07:41

Target

Xeno-v1.1.0-x64/Install dependencies.bat
Size

1KB
MD5

eb4b04fbf3be04946d84a01ede5cbe9a
SHA1

c03837830a409c2ef177925bd3e4ec9544cc5031
SHA256

f545d644196419b41eadae3f0846888c396284cc148c780916c0d96a07f71b40
SHA512

42dae275458e8f23383285087cda5dad95bfee58bdb86dc1b6c07373296e35f99fd3c249fe022a5bbd3e9b0a465b6231922267fb330d6b5febeb7a731d320749

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 5076	2104	cmd.exe	79
PID 2104 wrote to memory of 5076	2104	cmd.exe	79
PID 5076 wrote to memory of 456	5076	net.exe	80
PID 5076 wrote to memory of 456	5076	net.exe	80
PID 2104 wrote to memory of 988	2104	cmd.exe	81
PID 2104 wrote to memory of 988	2104	cmd.exe	81
PID 2104 wrote to memory of 3148	2104	cmd.exe	82
PID 2104 wrote to memory of 3148	2104	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.0-x64\Install dependencies.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:456
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64"
  2⤵
  PID:988
- C:\Program Files\dotnet\dotnet.exe
  dotnet --list-sdks
  2⤵
  PID:3148