5b9a396000622460864f616fe46f4232fae004838284a97c729f74c056f0a6c4

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 22:55

Target
Xenostrapper/Boostrapsrrer.exe
Size 4.2MB
Sample260905-2wbtsa1vbw
SHA256 5b9a396000622460864f616fe46f4232fae004838284a97c729f74c056f0a6c4
MD5 e531ed92c41db52616a6ac4a26d0dd6f
SHA1 f755cd38b7db43fe15d8decc8086cb1e7d2d5f13
SHA512 e5fb28db1d9bb7b2b4798596101066b6cfacdbd6336b7621921b9ac27302904b8b4493beb31c40285b9319c33ba6bd70331dca0c0d8cb1ea282101c5a630a76a
SSDEEP 49152:WO5gK9bQ8+QYQvqkmCMcvtxTg9Xryq83wGUvFgF8S:LSwvqgMc/TgJryP3wnvsz
TLSH
T156167C65061FCD0FCA4158F4987A7A639325B4C92B2096E8FD04B4E6B3D7D3A17A03F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 3360	2024	Boostrapsrrer.exe	89

C:\Users\Admin\AppData\Local\Temp\Xenostrapper\Boostrapsrrer.exe
"C:\Users\Admin\AppData\Local\Temp\Xenostrapper\Boostrapsrrer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -L --connect-timeout 10 --max-time 120 --retry 1 -A Microsoft-Symbol-Server/10.1700.661.0 -o "C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.pdb" "https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/953A8DE880B0818C32DA2DEC1D79C2D91/ntkrnlmp.pdb"
  2⤵
  PID:3360