5b1b6c9a43cf94d9c22ee0f0b6577836ce28abeae4624a43e3a0cbea54568e95

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 14:32

Target
2026-05-28_ec10685901b53da0c74f7b93ee630235_amadey_cobalt-strike_elex_emotet_hijackloader_maze_remco.exe
Size 838KB
Sample260528-rwpersbs5r
SHA256 5b1b6c9a43cf94d9c22ee0f0b6577836ce28abeae4624a43e3a0cbea54568e95
MD5 ec10685901b53da0c74f7b93ee630235
SHA1 5210ad237d76ff580283db0ff860907fadf7c527
SHA512 18b9216fa9702060497958aa35ccbf801f02ee4eaa4fb213ff4c61ec1ac72ab77d69bd526c05399722cfe296d463b23719c02a248e972406b7505461419ba890
SSDEEP 12288:9+5EM3H677d4xpVbuxrqSx54G2nCtAqOm5yOvei3Da+a62SYUcknnX:05v3H67p4x4rH54GXtA5H+nYUcknX
TLSH
T179059D01B7E18432F5B30A335DF687616A7AFC619E31CB0F67842A1DAE316819B35772
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2700	924	WerFault.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-28_ec10685901b53da0c74f7b93ee630235_amadey_cobalt-strike_elex_emotet_hijackloader_maze_remco.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_ec10685901b53da0c74f7b93ee630235_amadey_cobalt-strike_elex_emotet_hijackloader_maze_remco.exe"
1⤵
PID:924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 236
  2⤵
  - Program crash
  PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 924 -ip 924
1⤵
PID:4516