85f939d7f070e905a0ed179a84ac6cb2abd9d653043d73941e20f4e294550ebd | Triage

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08/03/2025, 14:30

Sharing

Report Analysis Logs

General

Target

Xeno-v1.1.5/XenoUI.exe
Size

92KB
MD5

62cf954ef49d2626596e2819fd53c522
SHA1

0fe59d80c8098df4c3e2e86965e21296f1990aa4
SHA256

ae092198b56673b33f5a413e52d821bdb525a6ad68f93ea8149e9114aab93560
SHA512

b1d23be7495b8485e051deba988c8f286390fb051f329c6a4e3fed67e6a4ad53f30c08ce1c67cdc4ff25aeae4cf1fd2c783bf96c4b5c180b14f7f4e6b218afde
SSDEEP

1536:bThjJu7t9kwqYJ2AP1z7AzTBxay2iZhMuM/APHV5y6SlSO8Gh:PFJotiwrezTBxaSL7Pby6SiGh

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1556	1956	XenoUI.exe	29
PID 1956 wrote to memory of 1556	1956	XenoUI.exe	29
PID 1956 wrote to memory of 1556	1956	XenoUI.exe	29

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.5\XenoUI.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.5\XenoUI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1956 -s 504
  2⤵
  PID:1556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-0-0x000007FEF5E03000-0x000007FEF5E04000-memory.dmp

Filesize
4KB

Download
memory/1956-1-0x000000013F900000-0x000000013F91A000-memory.dmp

Filesize
104KB

Download