44ba7bdb915dd85347112d5c1cd5dc954a54a002695adb9a8f55556b80b8ccad

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 06:09

Target
2026-07-10_0da4086335cb597f7a65e037ff5f496c_avoslocker_coinminer_darkgate_dosia_elex_glassworm_luca-.exe
Size 28.1MB
Sample260710-gwkfpsd16n
SHA256 44ba7bdb915dd85347112d5c1cd5dc954a54a002695adb9a8f55556b80b8ccad
MD5 0da4086335cb597f7a65e037ff5f496c
SHA1 a3717a816c72171c46e901f850a1269f20422eb2
SHA512 2c3d59d07df0ebb4a09fc76c4878921d1f55d742827283ef07f4e6ac1d54410f4d205da426939c3de6c7aecc5a36694efad20f9dcbf80cc1196a9e2fc738b67d
SSDEEP 196608:H65BBMILZtaFEXOcD4OBMhghhXFC7JbO1zbalMF09BQ9jwpMFpOy:H6FzJ9hwlbPZ6jwv
TLSH
T157575A11EAC740F6F9035871009BA22F63309D068F28CAD7FB5C7F69EB36A915937A45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/5920-0-0x0000000000970000-0x0000000002591000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5920-0-0x0000000000970000-0x0000000002591000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
7112	5920	WerFault.exe	87
4448	5920	WerFault.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-10_0da4086335cb597f7a65e037ff5f496c_avoslocker_coinminer_darkgate_dosia_elex_glassworm_luca-.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_0da4086335cb597f7a65e037ff5f496c_avoslocker_coinminer_darkgate_dosia_elex_glassworm_luca-.exe"
1⤵
PID:5920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5920 -s 548
  2⤵
  - Program crash
  PID:7112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5920 -s 552
  2⤵
  - Program crash
  PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5920 -ip 5920
1⤵
PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5920 -ip 5920
1⤵
PID:5020

memory/5920-0-0x0000000000970000-0x0000000002591000-memory.dmp

Download