680cca1f085534eb40b22c3ba1588ca67c32d717be3ba41a5d7566faf4245511

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-11-2024 12:24

Target

ADbypasser.exe
Size

81.1MB
MD5

3da1c82c5b450c9d7fd995fc3fff88f5
SHA1

47e8ce5aa9e54d1bc6d49afd4305825d837f5225
SHA256

680cca1f085534eb40b22c3ba1588ca67c32d717be3ba41a5d7566faf4245511
SHA512

3349faaa4039cc81dc1ff108ff921a33de6255c8be45e2288b92f02d65772b51ca515faac0f9648a70d14cf2336eea004925530be3fe1f863b414f24ca9eef3a
SSDEEP

1572864:EOGKlEWpk0hSk8IpG7V+VPhqYdfmE7cliwiYgj+h58sMwiYBYpXiiD:2Kew9SkB05awcf0wy5eYB

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2932	ADbypasser.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020b0f-1263.dat	upx
behavioral1/memory/2932-1265-0x000007FEF5F60000-0x000007FEF6552000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2932	2080	ADbypasser.exe	31
PID 2080 wrote to memory of 2932	2080	ADbypasser.exe	31
PID 2080 wrote to memory of 2932	2080	ADbypasser.exe	31

C:\Users\Admin\AppData\Local\Temp\ADbypasser.exe
"C:\Users\Admin\AppData\Local\Temp\ADbypasser.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\ADbypasser.exe
  "C:\Users\Admin\AppData\Local\Temp\ADbypasser.exe"
  2⤵
  - Loads dropped DLL
  PID:2932

C:\Users\Admin\AppData\Local\Temp\_MEI20802\python311.dll

Filesize
1.6MB

MD5
548809b87186356c7ac6421562015915

SHA1
8fa683eed7f916302c2eb1a548c12118bea414fa

SHA256
6c65da37cf6464507ad9d187a34f5b5d61544b83d831547642d17c01852599a1

SHA512
c0b63bf9908e23457cf6c2551219c7951bc1a164f3a585cde750b244fa628753ee43fde35f2aa76223fd9f90cf5ea582241ab510f7373a247eae0b26817198fc

Download Submit
memory/2932-1265-0x000007FEF5F60000-0x000007FEF6552000-memory.dmp

Filesize
5.9MB

Download