Analysis
- user interaction
yes - max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/04/2026, 22:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fatal.dll
Resource
win10v2004-20260130-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
fatal.dll
Resource
win11-20260130-en
0 signatures
150 seconds
General
- Target fatal.dll
- Size 293KB
- Sample260424-1xp75ady2k
- SHA256 66fb916c95301febcac48f5d853380fbecb95cd31b0fac8f2ccbb69d3098d955
- MD5 9941d78c03f58465a500be379f6cbff1
- SHA1 eebc5b00cffc0a22e551618182036412b7bd864c
- SHA512 b48a5ef1548fa212ea494c78bcb1f3283de6c3c5b58d0b0145a36ad46e1d1dcb7d64d686e9ebdcd52d679a227f7df4cf6ce484dc7d6bd0be36b0777b757c12ad
- SSDEEP 6144:wWTpWmjWx1koQ1/2pXqslD0WcnZ8Lk2qh:7prSx1//lcnZKqh
- TLSH T162546C49B2E415A9F1A75138D4A7E31BD9363851473197CF33E801183FB27E0E9BAB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4252 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4196 chrome.exe 4196 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeShutdownPrivilege 4196 chrome.exe Token: SeCreatePagefilePrivilege 4196 chrome.exe Token: SeShutdownPrivilege 4196 chrome.exe Token: SeCreatePagefilePrivilege 4196 chrome.exe Token: SeShutdownPrivilege 4196 chrome.exe Token: SeCreatePagefilePrivilege 4196 chrome.exe Token: SeShutdownPrivilege 4196 chrome.exe Token: SeCreatePagefilePrivilege 4196 chrome.exe Token: SeShutdownPrivilege 4196 chrome.exe Token: SeCreatePagefilePrivilege 4196 chrome.exe Token: SeShutdownPrivilege 4196 chrome.exe Token: SeCreatePagefilePrivilege 4196 chrome.exe Token: SeShutdownPrivilege 4196 chrome.exe Token: SeCreatePagefilePrivilege 4196 chrome.exe Token: SeShutdownPrivilege 4196 chrome.exe Token: SeCreatePagefilePrivilege 4196 chrome.exe Token: SeShutdownPrivilege 4196 chrome.exe Token: SeCreatePagefilePrivilege 4196 chrome.exe Token: SeShutdownPrivilege 4196 chrome.exe Token: SeCreatePagefilePrivilege 4196 chrome.exe Token: SeShutdownPrivilege 4196 chrome.exe Token: SeCreatePagefilePrivilege 4196 chrome.exe - Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe - Suspicious use of SendNotifyMessage 48 IoCs
pid Process 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe 4196 chrome.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4196 wrote to memory of 4336 4196 chrome.exe 96 PID 4196 wrote to memory of 4252 4196 chrome.exe 97 PID 4196 wrote to memory of 548 4196 chrome.exe 99 PID 4196 wrote to memory of 548 4196 chrome.exe 99 PID 4196 wrote to memory of 5800 4196 chrome.exe 100 PID 4196 wrote to memory of 5800 4196 chrome.exe 100 PID 4196 wrote to memory of 1544 4196 chrome.exe 101 PID 4196 wrote to memory of 4644 4196 chrome.exe 102 PID 4196 wrote to memory of 1544 4196 chrome.exe 101 PID 4196 wrote to memory of 4644 4196 chrome.exe 102 PID 4196 wrote to memory of 1452 4196 chrome.exe 103 PID 4196 wrote to memory of 1452 4196 chrome.exe 103 PID 4196 wrote to memory of 3512 4196 chrome.exe 104 PID 4196 wrote to memory of 3512 4196 chrome.exe 104
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fatal.dll,#11⤵PID:4120
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa8c6ec728,0x7ffa8c6ec734,0x7ffa8c6ec7402⤵PID:4336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1988,i,14193994148801121684,1925139730560577094,524288 --field-trial-handle=2092,i,673413097236005246,6678504087903509600,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2124 /prefetch:32⤵
- System Time Discovery
PID:4252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,7003111358208271152,18311790489810101231,262144 --field-trial-handle=2092,i,673413097236005246,6678504087903509600,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,3014332435183038664,374556360672581271,524288 --field-trial-handle=2092,i,673413097236005246,6678504087903509600,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2428 /prefetch:82⤵PID:5800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3108,i,2847632429053351626,67727410256258233,2097152 --field-trial-handle=2092,i,673413097236005246,6678504087903509600,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3120 /prefetch:12⤵PID:1544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,14239471299385059710,17920374820473797177,2097152 --field-trial-handle=2092,i,673413097236005246,6678504087903509600,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:4644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,16319136046375932051,8076562398842256170,2097152 --field-trial-handle=2092,i,673413097236005246,6678504087903509600,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4292 /prefetch:22⤵PID:1452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4780,i,11014227500012770159,9411459371794075151,2097152 --field-trial-handle=2092,i,673413097236005246,6678504087903509600,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4612 /prefetch:12⤵PID:3512
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5508
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 846a16abbced70ee0b4a382243ae3b2766b7146cf95c0b821a7bfe7c7bb89908
- MD5 08dae81d018fa7e3565455a357b28552
- SHA1 c90be5eec6889825ddee620e402a46ab90dd235c
- SHA512 589363838513d4dabe8c2caf7d8e23ecb5f0b035d975d35ba4f6edc14cffc6165253b91971f4322c208658afdefeaf1829c73029e527be31785007428b6a04eb
- TLSH T1F4518DB793E48A6E851156E49B257E2FDE6D0A24031C3C6289D8AF5B53E2973D20138E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 523B
- SHA256 18c193c6d56c7fc940a3acb077703823d7a5975bfd2223b985ab4473874a6ad3
- MD5 3e83e56ddca877c6e2e0ea7b4e77cbf4
- SHA1 47d0496d5e2c66f502f8531779a7b52f2cab6cae
- SHA512 d5f353b76486926f767cb8d46f06c5d52bf5a3b5a88253395f742b33f8e6201c57dc2935dc43358819cf0d7ce600a3c38f58eef8631020ebd7221d0713aad51d
- TLSH T15BF059BBB6B9749700BD497B1E18B8496DB6A831068128F4DEEA826CF0854E30F06417
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 fee443a27ffc5f4243b8225ce1ad97822b3ba1ee2b3f55fd28ad1412697332b9
- MD5 7d1affe44b18a940bf2dcf79003f87a0
- SHA1 3a4a04599b9e9b3a8cd7b609779a254a1cced9f0
- SHA512 87653807897aaf6a362d2fb02a6c074b6dc05a1f9a5f2e33ab0970d52e2be4ea1839112fd1917f71b549c6e0edb206812cc0d0f9e9ebac714740f2d1da56d96d
- SSDEEP 192:ERc+LfsC5pZYYv73pAPRp2V9YHsb+WNnuf0T8z2EGkw3Q2VyIsnAUge:ERc+IAYETUX6Cwg0T62EGXve
- TLSH T1ED52D72EAD18353B5CCBC629F9A17A57D7F5202275902E88EBFC8A2C14D76CE2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 faf205f38f14aaebb964cc4c6cac86c1d9eed1cc4597cf300d120c12563fcb8a
- MD5 cfbb6fe69b1dcf37ae21233f58e196af
- SHA1 ed1c796023f5198d2aee9d10882084cdf4376191
- SHA512 b9f045a63479b9bdf49685c0d4fc4c6a89a446e520e63af89b50cd1c6be690f1e59e8fa198935484ea5c349cca94ef2e2362cf52b4b372d92b7c9f519f144eb0
- SSDEEP 384:rVjn27KxkXqKf/pUZNCgVLH2HfgsljM7pLuLcifx8XODnS+ErU3iIHGk0cvXwv:rFn27KxkXqKf/pUZNCgVLH2HfgslM7pd
- TLSH T14A7209A77C4C9E770F94C6CCDC267E4F9CB5024A65E9886883FA982903D5ACF114A1F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 2377165a2de185b2b500adb07914a95cfb013081aa036b8fa933e94675ac4eea
- MD5 5379770a591c9a8745dcb863991fe514
- SHA1 7a629e3c38af5905d79c302ed22e233e17e695e7
- SHA512 9903f7c3771256b25bc5493cfbab3a9c4fc0be612ae8e60e8701d031af0ffb5f1d961f3739e1baf4694361ced070f783f4ffdcb4a7627c9683d6d269694310a2
- TLSH T1C3B012208002D504C04301F41193048C3144DF11C618330557E46EF1AC2E0A14015550
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58265f.TMP
- Size 96B
- SHA256 e38137c3477b7dc5b22d44a69c63f9d46e07e88a4d6fda476a24e3a45d4f29e2
- MD5 2d46d4616da8a5f47e08dbbce445c2a1
- SHA1 3cb4fc5c6ec136ee505f93375ba7ebbcef1f46b8
- SHA512 51def3e151865f00950d69a5296b2c1a87751ecdb4417ddc5c48d65064c1aa03835a922015a0bcf779d13643351ef6a17f0e33902713688e11c68a257836b302
- TLSH T163B002A5D103A313C18303B065D696EC7660EFADC6035623E2F12EAEDC35A714539560
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 3ac04188ee73b04ad48c8837177e03c02691d52164a274659b2fe1a654996f3d
- MD5 01ab63214314ae9b24a97771597e54c6
- SHA1 d91ad56cecb08435935a117e871fc50d94aa1f1a
- SHA512 435244b945bd326f6084fadb698d8b66e2aaccf052bbf4d97f1f93e078a019bcbc08765de0e191ca6aad525bf80cd36bdcd58f3151c1330e8d9d01523e70b44d
- SSDEEP 1536:NrKxXcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Y:tcX3Qw/xLANk0mUW5GmRntSFCjEENg
- TLSH T1189312B95E2A45F755BE469172AE7C0ACE12230D715FA9CC3268A39D21C41CD2B73E33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 64cc0af1d5a178cc884a53a43cb0d3a03fd46f303d19a6ac369dc6ead113c438
- MD5 72c2345f441c8e7b8304290132be5402
- SHA1 08732a05cec578c0553b02d7aa340f6397e8321c
- SHA512 1e73ea71c860b8018748ccf7a132bffc34a89ce29838ead26eb67ff854161715e553a6df55f4dcf87514e97225f9a556cb711dfda55462223cacc6e08c2484b4
- SSDEEP 1536:566cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEj:j3Qw/xLANk0mUW5GmRntSFCjEENV
- TLSH T10A9312B94E1B46F7957D468276AE7809CE12230D709FA9CC316CA39C21D41C92B73E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 3d84b30a1ff1f50b0d18773a7c94f4cea0913e76abb3103b9840b747f39d2998
- MD5 4141bc08dd94e08444803b3be6aedf8b
- SHA1 9a2ae9d928b9688c3266be16c8467f6d6700f6f9
- SHA512 bd06cedebb963875666e9ee544cbb518146febe59d831894b356e1009482155db7cbdd219d8ed3b0908a1918283191160bfc076ea153b3e2e366b2cf1d995399
- SSDEEP 1536:NdKxacYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Y:Lca3Qw/xLANk0mUW5GmRntSFCjEENg
- TLSH T1D09312B95E2B45F755BE469172AE7C0ACE12230E715FA5CC3268A39D21C41CD2B73E23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP