3536d9579dedc24f8bbba0d0cf3279a2682afc1376a73fbde1fe3e11d0431e27

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 16:07

Target
2026-04-15_5a8f5eb1c39bd1a0d6ef56ed277c0be2_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader.exe
Size 712KB
Sample260415-tk427ads4j
SHA256 3536d9579dedc24f8bbba0d0cf3279a2682afc1376a73fbde1fe3e11d0431e27
MD5 5a8f5eb1c39bd1a0d6ef56ed277c0be2
SHA1 f1fa67558cb15f113188fc4ddbb5e75c167b8d93
SHA512 d0e3621cbeecc338e082f7349ed4642fc912876d80cd5a73416521382fe3300fec69fbb0ed3e027483cb758d7ecfca4208a481f4e63c9720cae0d832ee449288
SSDEEP 12288:OHD54G2nC/FNn3GzvXk14AwSfxL/2Dc3jDLLmt0LDQewsAjRE:OHD54GXX3Gjk1daewsAju
TLSH
T1CEF49D22FBB0D032D6BB09B15A75D706587DBA210F615AC7E3E89A9E1D703C12732B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2664	4972	WerFault.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-04-15_5a8f5eb1c39bd1a0d6ef56ed277c0be2_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_5a8f5eb1c39bd1a0d6ef56ed277c0be2_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader.exe"
1⤵
PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 8
  2⤵
  - Program crash
  PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4972 -ip 4972
1⤵
PID:2388