42609a2d59ebbe1d6c2c3d6c020ce57c800d299de866578e3c545b659c68aaaa

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 22:12

Target
PipeBypass.exe
Size 141KB
Sample260714-14ltaaew8j
SHA256 42609a2d59ebbe1d6c2c3d6c020ce57c800d299de866578e3c545b659c68aaaa
MD5 98a79a2f7d747276273be1a9ad9e3c04
SHA1 2938b78e557d11bb78ed5ace9fd80a78c899576b
SHA512 b22550c06d0e01d0f1f40900c9fb5b04667e148c77780adfc46164fafdbac6fa967694c5752d946b08a8534202e45e653e68f4281e503858ea948c89f1d89872
SSDEEP 768:5KD9gNFB9H4ZNoAuWrjzVtXyUZ4nuWHTLReILjJ/To/QJa7HmbCyO/8d9Sbh9Sb:5TB9HAHT/ADHTNbLjZoGdpO/qC
TLSH
T119E3E71396DC3CCAC038A3B473BB93D1D32EEC5592A2C18F96D04295DABE19779227D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 5496	4844	PipeBypass.exe	88
PID 5496 wrote to memory of 700	5496	cmd.exe	89
PID 4844 wrote to memory of 1984	4844	PipeBypass.exe	90
PID 1984 wrote to memory of 4568	1984	cmd.exe	91
PID 4844 wrote to memory of 5776	4844	PipeBypass.exe	92

C:\Users\Admin\AppData\Local\Temp\PipeBypass.exe
"C:\Users\Admin\AppData\Local\Temp\PipeBypass.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp 65001 >nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5496
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con cols=55 lines=24
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\system32\mode.com
    mode con cols=55 lines=24
    3⤵
    PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5776