10004265fd35c35e8ade23d6e76a73c8ecea99bb40fca44dbf17b779433c28f0

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 01:39

Target
2026-07-13_29e98eebdb6418c6db19565c100468f3_avoslocker_coinminer_darkgate_dosia_elex_glassworm_luca-.exe
Size 28.1MB
Sample260714-b22paaev6w
SHA256 10004265fd35c35e8ade23d6e76a73c8ecea99bb40fca44dbf17b779433c28f0
MD5 29e98eebdb6418c6db19565c100468f3
SHA1 43bd771b31ba936999b97911b7ea4c67eaba604c
SHA512 99c6df13068bc1c176ee760f70355836ad77b6ca554a93a8983079bbd63c4774f57f413b40b35466dd1644de68a4c6a70c88e8c1b00f6dfc5c5f02abeb98139b
SSDEEP 196608:dEzf8tqFEXOcD4OBMhghhXFC7JbO1zbalMF09BQ9jwp6NeHy:dEzAJ9hwlbPZ6jwH
TLSH
T170574A11EAC740F6F9035871409BA22F23309D068F28DAD7FB4C7F69EB36A925937645
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/2516-0-0x0000000000140000-0x0000000001D58000-memory.dmp	UPX
behavioral2/memory/2516-1-0x0000000000140000-0x0000000001D58000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2516-0-0x0000000000140000-0x0000000001D58000-memory.dmp	upx
behavioral2/memory/2516-1-0x0000000000140000-0x0000000001D58000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3000	2516	WerFault.exe	86
2596	2516	WerFault.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-13_29e98eebdb6418c6db19565c100468f3_avoslocker_coinminer_darkgate_dosia_elex_glassworm_luca-.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_29e98eebdb6418c6db19565c100468f3_avoslocker_coinminer_darkgate_dosia_elex_glassworm_luca-.exe"
1⤵
PID:2516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 552
  2⤵
  - Program crash
  PID:3000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 556
  2⤵
  - Program crash
  PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 2516 -ip 2516
1⤵
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2516 -ip 2516
1⤵
PID:3080

memory/2516-0-0x0000000000140000-0x0000000001D58000-memory.dmp

Download

memory/2516-1-0x0000000000140000-0x0000000001D58000-memory.dmp

Download