d825706f6385197d29747fb58aa23bebb189052452f0e2c96a6e83f4927d935b | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/03/2025, 02:54

Sharing

Report Analysis Logs

General

Target

Xeno-v1.1.6/XenoUI.exe
Size

93KB
MD5

2762fa6dd3c21a58ffd5a5a7bbfdec29
SHA1

afc64d9614723a56f980db7f0ea314cb4b8f7f02
SHA256

561478b7b91cfca4b0e59fddef42e2697655007feeceb594cb38f5071f2b7649
SHA512

648868af575edfd55e3b947df6239ee34ecd99522bf9ccef7998dfc44ba3f81351d8362240ad984d1757e4e2fb3d93eab47a16e8d7fbf82a1aaf13ab3d0771eb
SSDEEP

1536:DhGhD/eZUZ4fzT8xDc3WNJhfuM/APHV5y6SlSO8Xh:whaKWzT8xDB27Pby6SiXh

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2880	2284	XenoUI.exe	28
PID 2284 wrote to memory of 2880	2284	XenoUI.exe	28
PID 2284 wrote to memory of 2880	2284	XenoUI.exe	28

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.6\XenoUI.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.6\XenoUI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2284 -s 504
  2⤵
  PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2284-0-0x000007FEF5233000-0x000007FEF5234000-memory.dmp

Filesize
4KB

Download
memory/2284-1-0x000000013FF40000-0x000000013FF5A000-memory.dmp

Filesize
104KB

Download