b906ea158a4d51a0f3e3b5796b6f378bd1221515be1b90127de570c161734bee

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 22:25

Target
2026-08-17_3f6ea9221987fc3e58fc537cf98e8135_avoslocker_coinminer_darkgate_dosia_elex_glassworm_luca-.exe
Size 32.3MB
Sample260817-2cfcvs1whw
SHA256 b906ea158a4d51a0f3e3b5796b6f378bd1221515be1b90127de570c161734bee
MD5 3f6ea9221987fc3e58fc537cf98e8135
SHA1 213cba0dba0833b36f96ec7df8c1e3b89a623e4d
SHA512 60d1d2e3670410f292a77d9e0d1fdc7dd08407ecdcb4fc38e3b4b422b8d58da52399a6735a6705643d1b321c6081907f3117d56539cd8793737bd5ad7d42ed48
SSDEEP 393216:0/AU/QuvL5wvQ1bhKot2hdXy/lX32PQdUZ:YAUsQyoLy
TLSH
T18E774950FAC301F5EA031971519BB22F23305D068B28DBD7F74C7A2AFB37692197664A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/3040-0-0x0000000000B70000-0x0000000002BC8000-memory.dmp	UPX
behavioral2/memory/3040-1-0x0000000000B70000-0x0000000002BC8000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3040-0-0x0000000000B70000-0x0000000002BC8000-memory.dmp	upx
behavioral2/memory/3040-1-0x0000000000B70000-0x0000000002BC8000-memory.dmp	upx

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3472	3040	WerFault.exe	88
2652	3040	WerFault.exe	88
4032	3040	WerFault.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-17_3f6ea9221987fc3e58fc537cf98e8135_avoslocker_coinminer_darkgate_dosia_elex_glassworm_luca-.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_3f6ea9221987fc3e58fc537cf98e8135_avoslocker_coinminer_darkgate_dosia_elex_glassworm_luca-.exe"
1⤵
PID:3040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 560
  2⤵
  - Program crash
  PID:3472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 568
  2⤵
  - Program crash
  PID:2652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 584
  2⤵
  - Program crash
  PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3040 -ip 3040
1⤵
PID:2052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3040 -ip 3040
1⤵
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3040 -ip 3040
1⤵
PID:5516

memory/3040-0-0x0000000000B70000-0x0000000002BC8000-memory.dmp

Download

memory/3040-1-0x0000000000B70000-0x0000000002BC8000-memory.dmp

Download