24771d0a69e442b9493ab1406e0253be1acd31d83f593177fd736f7f6d629ed9

Resubmissions

19/08/2026, 16:53

260819-vec7ysycrc10

14/08/2026, 17:08

260814-vnkndseq2s10

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
24771d0a69e442b9493ab1406e0253be1acd31d83f593177fd736f7f6d629ed9.dll
Size 1.1MB
Sample260819-vec7ysycrc
SHA256 24771d0a69e442b9493ab1406e0253be1acd31d83f593177fd736f7f6d629ed9
MD5 a239e655709a2518dd0b7bdbed163679
SHA1 79f3ef6c6127edb0a5f43ef7a16bfb3418860e19
SHA512 6e30e44f776225c37176831afc229fd96bbcd22f893592d861e53a9e2800d5380f7e274a5e293eb7e965e00e6cb724990385f419be3ce5079cc7653f965a6498
SSDEEP 24576:JoFW1Q4DFEDUPjvCO8yhGJbvoj7VVg0Afa61lnNd4R9kOPMKjLTNgRz/tMH3NQPw:JoFW24Dyora5AMvoj7c0bPbkOPMUNgRN
TLSH
T1DC359D0ABA8E10F4C5A9D0B886979512FB75385A5931FFDF46D422662F37FA01F2B304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3972	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2888	chrome.exe
2888	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe
Token: SeShutdownPrivilege	2888	chrome.exe
Token: SeCreatePagefilePrivilege	2888	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe
2888	chrome.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2812	2888	chrome.exe	103
PID 2888 wrote to memory of 3972	2888	chrome.exe	105
PID 2888 wrote to memory of 3416	2888	chrome.exe	106
PID 2888 wrote to memory of 3416	2888	chrome.exe	106
PID 2888 wrote to memory of 2668	2888	chrome.exe	108
PID 2888 wrote to memory of 2668	2888	chrome.exe	108
PID 2888 wrote to memory of 3728	2888	chrome.exe	109
PID 2888 wrote to memory of 892	2888	chrome.exe	110
PID 2888 wrote to memory of 3728	2888	chrome.exe	109
PID 2888 wrote to memory of 892	2888	chrome.exe	110
PID 2888 wrote to memory of 3260	2888	chrome.exe	111
PID 2888 wrote to memory of 3260	2888	chrome.exe	111
PID 2888 wrote to memory of 4912	2888	chrome.exe	112
PID 2888 wrote to memory of 4912	2888	chrome.exe	112

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24771d0a69e442b9493ab1406e0253be1acd31d83f593177fd736f7f6d629ed9.dll,#1
1⤵
PID:4848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffedb70c728,0x7ffedb70c734,0x7ffedb70c740
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1996,i,14273757432092246321,1801171111811069173,524288 --field-trial-handle=2016,i,13446087918338161057,3194835405497950845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2036 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,726923206889482307,11873546961577699978,262144 --field-trial-handle=2016,i,13446087918338161057,3194835405497950845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,15920359836585815106,11367501629459422376,524288 --field-trial-handle=2016,i,13446087918338161057,3194835405497950845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,15673030739833137213,10288972990661042610,2097152 --field-trial-handle=2016,i,13446087918338161057,3194835405497950845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,3442924156640006016,1702964669130931420,2097152 --field-trial-handle=2016,i,13446087918338161057,3194835405497950845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4560,i,4372984276874272286,2066267476352963777,2097152 --field-trial-handle=2016,i,13446087918338161057,3194835405497950845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4736,i,3026532507574755274,548372390349524421,524288 --field-trial-handle=2016,i,13446087918338161057,3194835405497950845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:4912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d5307c8eb7b58e9988f21ef5f597e1054b67f1b38ea96f70c5057aafc6ad0034
MD5 d77a63e98e5379f1718306f5b1d6a379
SHA1 5d963192ad2a1d4cb000b6cf2bbe6e19bbbaf13b
SHA512 5d1d61461dc9c2d807ac59e505c9bad26b34c7e9d3083512de20cf2fc8a2b07c661af7877833ff022fbd38d3a3fd3922d320d1a06cb967df20adb9d9924c8f13
TLSH
T182317BF7C3E4997D890192F49A15AF1FCE690A14531C3C66C9D4AE1F43E2972E20068F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 6c933e9fa724c16d1ccc6777a0cb15ee15e825258317fcc22c2aba16b0e451d6
MD5 90c76d1cd6b1fd8a60d36adf7b4e1c78
SHA1 f8e37e7a6551ffafa8cc688f5171793f19627f8f
SHA512 fc3d02ec9f5c31059d8d56b68b8daa13d18da03ccbda456e75c1546c0e29c8191b1ee4f733375da4148a106da0282878b16cea8d56fb320f5d6b9964eda92b4b
TLSH
T178E02067D76970AB41F885AB1D44BC176975A83602452CD0CEA6C1ADD0548F31F01567
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 d3f782fd041e305d1b00ff852715292d2152d9461ab43c056ff486d99fafc209
MD5 ac464782df8c7df32b5c680f703329cd
SHA1 465e3aa876d18b8058688e68b6f799bb3496b397
SHA512 eca552d9635531d0c1ce3b04895b41964916b1b5938bf225dc2cb08eae3350394161f3eb88cf048198d11334f96502960d638e712d500ebdc9edb046649b5629
SSDEEP 192:LRpIHRgQv72vAPRp299THsb+WNnFBd4QpPyIsnAUge:LRpIxgMC6XuFwzd4ke
TLSH
T17A22831EAD24653B9DDAD21AFA617767E3F5103135E02E80EAFC893C25D75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 0e75131aaa6672bd96fc5172c84314adb544f96f923ba5f55638cc0cc7c4fd10
MD5 f7ecd2663dd9b607d05a987f1e9062e1
SHA1 fc89a052d8afee7d33fe721054cfef87989eeb3b
SHA512 77facfa4254e7b5227b6d99855b9d11e57aa3e11286fecacbc84ae02e09da0879448561da5b988d0ce2cbf2c294cd9696f094884ecf79a9ae1929f9550f0c186
SSDEEP 3072:M5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMH:M4m7Rkm1tYpBeh2BAoH
TLSH
T154C3023B5D74E83759B9B75EB08E0B1F1EF14AA2C934DA92C8D45A0433EA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 40d303c57800155e5b05bf776f8c5b652b603a4012b574af2d514b5f9cb99ad7
MD5 121a2913442258eb5ee70603108da5e0
SHA1 612c774324fbde7c1d8bf537b5124ee171d38ce3
SHA512 e6e2e24bed91f945afe649387af43602f7d802e593d43f6d228a0e759c8ed7f6398010a0000628fd3229ac478bbd02a335e5f616264a2a2e3aed88db36b02980
SSDEEP 3072:6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:dm7Rkm1tYpBeh2BAom
TLSH
T143C3123B5E70E9775979B74EB08E0B1F1EF14AA2C930DA82C8D85A0437FA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4848-0-0x000001CD722B0000-0x000001CD723C5000-memory.dmp

Download