563e352dd816eed8ae5b7496f13999aee8b8836613618f7ea2e3750427c58fb8

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 15:18

Target
2026-05-18_0ac8e112c0b45e773836ea7704f34e86_amadey_cobalt-strike_darkgate_elex_emotet_hawkeye_hijack.exe
Size 2.5MB
Sample260518-sp43baex2x
SHA256 563e352dd816eed8ae5b7496f13999aee8b8836613618f7ea2e3750427c58fb8
MD5 0ac8e112c0b45e773836ea7704f34e86
SHA1 c78737a9381a5f226d78ac2723d69b035a51bd2f
SHA512 122aa7c5170c57ce3d20fdb8c24a95bb19a69913ec112e0a8d4b0b01244291b92695b002b699520dc3aae429b8b9e601cc0fb299bafa9c621d6cddae9811a5d6
SSDEEP 24576:emL7nccuzKPgssStPUvg32ROf1IegqutJQ5FeQzcuC4r6HQqD5TvinrmfzauU:jghKPgssSt2g32RAR5FeA6wM56r22l
TLSH
T110C55A0173E48679F1BB66719DB582369A73BC605F35C7CF13809A5E2E71A809A32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3260	3884	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-18_0ac8e112c0b45e773836ea7704f34e86_amadey_cobalt-strike_darkgate_elex_emotet_hawkeye_hijack.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-18_0ac8e112c0b45e773836ea7704f34e86_amadey_cobalt-strike_darkgate_elex_emotet_hawkeye_hijack.exe"
1⤵
PID:3884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 156
  2⤵
  - Program crash
  PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3884 -ip 3884
1⤵
PID:3816