71d5fabdd8b478089e543ab6a6e92fa1bcf822ca095ee9ace7789e665c495dec

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 01:59

Target
XenoExecutor.exe
Size 28.1MB
Sample260719-cel6ract6s
SHA256 71d5fabdd8b478089e543ab6a6e92fa1bcf822ca095ee9ace7789e665c495dec
MD5 93cc155253429c5d55a4d35c41f11a33
SHA1 001e146ce340e22096824e3428aaafd95fce6528
SHA512 0e51c014e0dc3e50d31c1e3752aff256837c289eb19ec2bae23047b68ceab7c46a35aec07ce19d45b4703bc5846405f3449088530227549e4494c20dbb5eb4a3
SSDEEP 49152:ToAnT5THZp2mLlODnSiGLGqna/x5qIj5yPgFjs913k/BRHGfoN0IrR/ZDlGIBLOH:TdK1qna/x5qIji3WjHHNPO100c+R6M
TLSH
T1C1577C07AFDC07FCD567C7FC89AB9B32C6F1B86A8622C24B0554C7151E729B14E6A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5068 set thread context of 3684	5068	XenoExecutor.exe	89

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 3684	5068	XenoExecutor.exe	89
PID 5068 wrote to memory of 3684	5068	XenoExecutor.exe	89
PID 5068 wrote to memory of 3684	5068	XenoExecutor.exe	89
PID 5068 wrote to memory of 3684	5068	XenoExecutor.exe	89
PID 5068 wrote to memory of 3684	5068	XenoExecutor.exe	89
PID 5068 wrote to memory of 3684	5068	XenoExecutor.exe	89

C:\Users\Admin\AppData\Local\Temp\XenoExecutor.exe
"C:\Users\Admin\AppData\Local\Temp\XenoExecutor.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:3684

memory/3684-0-0x0000000360000000-0x0000000360228000-memory.dmp

Download