56082b3b9df31d93241ae986e801172ca7214160f4093c76e4f026b4c0091a78

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 13:22

Target
2026-04-17_b0044fc7760ca834c43b485e3846489f_amadey_darkgate_elex_smoke-loader_stop.exe
Size 1.1MB
Sample260417-qmapkshz2w
SHA256 56082b3b9df31d93241ae986e801172ca7214160f4093c76e4f026b4c0091a78
MD5 b0044fc7760ca834c43b485e3846489f
SHA1 af07200b7c116652e96605d8622e6724f3a44e4f
SHA512 e50fa32d7130d2ea2cd06cb468cef6dd7e1d852a947cf7ec60732e20378758094a84e3cba85e712975a97a3d9c35cf08d8b16f5c3f9581f2f4a176e52ca8f74b
SSDEEP 12288:hCWVksocuzkB/X/2xlsxjbN3FFcSRPPbYNtGDjq:LV3ocuzKPgssStPUvgjq
TLSH
T1D245F802A7F94129F6F37B70DEB992605A77BDA15D36C51E23C0325E0DB0A90AA31737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2660-0-0x0000000000400000-0x000000000059C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4744	2660	WerFault.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-04-17_b0044fc7760ca834c43b485e3846489f_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_b0044fc7760ca834c43b485e3846489f_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
PID:2660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 8
  2⤵
  - Program crash
  PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2660 -ip 2660
1⤵
PID:4992

memory/2660-0-0x0000000000400000-0x000000000059C000-memory.dmp

Download