d9013c1476387330999900f827778cdd65370dddb79c0683d0f932c9c81bb36a

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chrome.exe
Size 14.5MB
Sample260924-sv716aware
SHA256 d9013c1476387330999900f827778cdd65370dddb79c0683d0f932c9c81bb36a
MD5 b5cbc7352b02a1918d48c86ae9bea942
SHA1 75490af0b80bb9464df341a29989dc2321e0f696
SHA512 320415b1359feb33440ef0913c9a7538551e8cb81cf4f98239a3cdefb7658202c4cd592a30e2330a53c3f8a4352fce59f5c057927235a98ff3b3ca5d68246abd
SSDEEP 393216:5vuDm2gWP2JPJImj3J0yaqg3TP4To1H8LOI490:V72aPXbGqS8wLr0
TLSH
T18AE633B77BB70039E1344AB4509F97D096DBF457A21CBAEB1979C2643A3071E467C0D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
3760	gupdater.exe
4212	gupdater.exe
892	gupdater.exe
4968	crashpad_handler.exe
4572	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
892	gupdater.exe
892	gupdater.exe
892	gupdater.exe
892	gupdater.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe
4968	crashpad_handler.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3760	2972	Chrome.exe	94
PID 3760 wrote to memory of 4968	3760	gupdater.exe	105
PID 892 wrote to memory of 4968	892	gupdater.exe	115
PID 892 wrote to memory of 4572	892	gupdater.exe	116
PID 4968 wrote to memory of 2264	4968	crashpad_handler.exe	118
PID 4968 wrote to memory of 4184	4968	crashpad_handler.exe	119
PID 4968 wrote to memory of 3464	4968	crashpad_handler.exe	123
PID 4968 wrote to memory of 852	4968	crashpad_handler.exe	124
PID 4968 wrote to memory of 1584	4968	crashpad_handler.exe	125
PID 4968 wrote to memory of 4820	4968	crashpad_handler.exe	126
PID 4968 wrote to memory of 1196	4968	crashpad_handler.exe	127
PID 4968 wrote to memory of 3196	4968	crashpad_handler.exe	128
PID 4968 wrote to memory of 4716	4968	crashpad_handler.exe	129
PID 4968 wrote to memory of 5032	4968	crashpad_handler.exe	130
PID 4968 wrote to memory of 4940	4968	crashpad_handler.exe	131
PID 4968 wrote to memory of 4104	4968	crashpad_handler.exe	132
PID 4968 wrote to memory of 1312	4968	crashpad_handler.exe	133
PID 4968 wrote to memory of 2288	4968	crashpad_handler.exe	134
PID 4968 wrote to memory of 4972	4968	crashpad_handler.exe	135
PID 4968 wrote to memory of 1096	4968	crashpad_handler.exe	136
PID 4968 wrote to memory of 4772	4968	crashpad_handler.exe	137
PID 4968 wrote to memory of 448	4968	crashpad_handler.exe	138
PID 4968 wrote to memory of 1128	4968	crashpad_handler.exe	139
PID 4968 wrote to memory of 4476	4968	crashpad_handler.exe	140
PID 4968 wrote to memory of 904	4968	crashpad_handler.exe	141
PID 4968 wrote to memory of 4500	4968	crashpad_handler.exe	142
PID 4968 wrote to memory of 3608	4968	crashpad_handler.exe	143
PID 4968 wrote to memory of 3668	4968	crashpad_handler.exe	144
PID 4968 wrote to memory of 2280	4968	crashpad_handler.exe	145
PID 4968 wrote to memory of 5000	4968	crashpad_handler.exe	146
PID 4968 wrote to memory of 3928	4968	crashpad_handler.exe	147
PID 4968 wrote to memory of 1040	4968	crashpad_handler.exe	148
PID 4968 wrote to memory of 888	4968	crashpad_handler.exe	149
PID 4968 wrote to memory of 3032	4968	crashpad_handler.exe	150

C:\Users\Admin\AppData\Local\Temp\Chrome.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\ProgramData\Google\Update\hsmz6zq4\gupdater.exe
  "C:\ProgramData\Google\Update\hsmz6zq4\gupdater.exe" /install2
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\SYSTEM32\certutil.exe
    certutil -addstore Root "C:\Users\Admin\AppData\Local\Temp\gucert_tmp.cer"
    3⤵
    PID:4968

C:\ProgramData\Google\Update\hsmz6zq4\gupdater.exe
"C:\ProgramData\Google\Update\hsmz6zq4\gupdater.exe" /svc
1⤵
- Executes dropped EXE
PID:4212

C:\ProgramData\Google\Update\hsmz6zq4\gupdater.exe
"C:\ProgramData\Google\Update\hsmz6zq4\gupdater.exe" /svc
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:892
- C:\ProgramData\Google\Update\hsmz6zq4\crashpad_handler.exe
  "C:\ProgramData\Google\Update\hsmz6zq4\crashpad_handler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2264
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4184
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3464
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:852
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1584
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4820
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1196
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3196
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4716
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5032
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4940
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4104
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1312
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2288
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4972
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1096
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4772
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:448
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1128
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4476
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:904
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4500
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3608
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3668
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2280
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5000
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3928
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1040
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:888
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3032
- C:\ProgramData\Google\Update\hsmz6zq4\chrome.exe
  "C:\ProgramData\Google\Update\hsmz6zq4\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1p4zspqfwvav4azyxgq3s3gzf2vsu8z6tch8f5r268kac57tt4azcq6jf0jx.OPSJLZUQ
  2⤵
  - Executes dropped EXE
  PID:4572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

chrome.dll

Path C:\ProgramData\Google\Update\hsmz6zq4\chrome.dll
Size 251KB
SHA256 a713aa6571f10b3a01f886a6e51a30028d37406a218932197480fdc5aa6ee39a
MD5 15cc8ae21a9f90b21564e046e6eab319
SHA1 98e241f09da5b31bfd420c5d68224fee16d4f591
SHA512 b45c5060b0f79fd3c6349c87ddd090f4e71764e874c8bb0a5feca74613688fe26da7224494e9247787666de72c732f99c86ac8b582c831677c2e1c82830868a7
SSDEEP 6144:V93zEaxe/JFA2BPlJ4WaK8s11ytcUe1NeN9JFaoEu:VNEaxefA2Lh8s3Tel2u
TLSH
T1314423ADB252B57FCAAB143CE2568651FCB139E80CA52E34D414D1321A79A8D3F324DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\ProgramData\Google\Update\hsmz6zq4\chrome.exe
Size 112KB
SHA256 6aeb069e0bc493ae0989b9806d6bf88361f5ecb6a1c62bd5d907f0218b311dc8
MD5 71075c136f9d00f87fe2482840c00e6a
SHA1 0e656eb1fd9fae2d2594b0cf606070e5019a4534
SHA512 df0b1c610fc48881db16e67e89d5e49f4eb5e24a4b0125bd384a897fa4f2fa3069fd55550665ec427b87bf030ff3600cb3b94a8011d10207fae1a4a7990c71d9
SSDEEP 3072:AHrIfsDDUz7g+hUmFULwixPhyIoOJ4omwZdwg:oIfICaziDs6
TLSH
T1CDB35B0BF29360FCC28BC234959796B1FA717C2506356F3FA990E6353D31E106A5DE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashpad_handler.exe

Path C:\ProgramData\Google\Update\hsmz6zq4\crashpad_handler.exe
Size 99KB
SHA256 c2eee2173c1a71071aae869744aa808793edeeec783d2b9e9de4917ce710d3c9
MD5 745f8edc8987ce34fc78d483a11b35f7
SHA1 aeda738f80431750c55d239977104d07ffc25dfc
SHA512 f58fdda97ff3598ac20f0c4fd943f67073305fb5750ac19c038744871810a0725e9cee2b56b5ecd640072ee36a4673b3da42d96bcae27e15291520512241e488
SSDEEP 1536:/MeIydPURCheGx02zyLDg2SIbP6/HBOTFTfo5OJjleomwjVDBX07:/M1ohzGg2NP6Pi9o8J4omw5D107
TLSH
T1FEA31947F29364ECC257C13491979672FB31BC750535AF7FAAA0CA752D20D20AE2CE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gupdater.exe

Path C:\ProgramData\Google\Update\hsmz6zq4\gupdater.exe
Size 14.5MB
SHA256 d9013c1476387330999900f827778cdd65370dddb79c0683d0f932c9c81bb36a
MD5 b5cbc7352b02a1918d48c86ae9bea942
SHA1 75490af0b80bb9464df341a29989dc2321e0f696
SHA512 320415b1359feb33440ef0913c9a7538551e8cb81cf4f98239a3cdefb7658202c4cd592a30e2330a53c3f8a4352fce59f5c057927235a98ff3b3ca5d68246abd
SSDEEP 393216:5vuDm2gWP2JPJImj3J0yaqg3TP4To1H8LOI490:V72aPXbGqS8wLr0
TLSH
T18AE633B77BB70039E1344AB4509F97D096DBF457A21CBAEB1979C2643A3071E467C0D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gucert_tmp.cer

Path C:\Users\Admin\AppData\Local\Temp\gucert_tmp.cer
Size 757B
SHA256 f6f77531bb012e1ce9b407f3ba98a472a36a315a011136e7e992712e3d266eb9
MD5 54233c86c9d065b26e62dd2bcf217c2b
SHA1 9b33f8aadb1efbc497fa7a1833d53e9b56a7498f
SHA512 bd96a567b8fdca2dc22624364f99274e23a8ba1c80c3807a638f952a0e9bb920464d75efd09e175b0e73c11fafcab4e3e97354c1104902b2d2eea8ff23f46b8f
TLSH
T17D01757DAB34790F2B05D413718ED3172833E8F86CAC18575A3799D349116A05E88614
MD5 SHA1 SHA512 TLSH

Submit Download

memory/892-35-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/892-47-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/892-46-0x00007FF6FC640000-0x00007FF6FC654000-memory.dmp

Download

memory/2972-39-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/2972-38-0x00007FF7D2DB0000-0x00007FF7D2DC4000-memory.dmp

Download

memory/2972-11-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/2972-0-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/2972-9-0x00007FF7D2DB0000-0x00007FF7D2DC4000-memory.dmp

Download

memory/2972-1-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/3760-34-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/3760-36-0x00007FF6FC640000-0x00007FF6FC654000-memory.dmp

Download

memory/3760-15-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/3760-10-0x00007FF6FC640000-0x00007FF6FC654000-memory.dmp

Download

memory/4212-44-0x00007FF6FC640000-0x00007FF6FC654000-memory.dmp

Download

memory/4212-45-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/4212-40-0x00007FF6FC640000-0x00007FF6FC654000-memory.dmp

Download

memory/4572-62-0x0000021986060000-0x0000021987068000-memory.dmp

Download

memory/4572-64-0x0000021986060000-0x0000021987068000-memory.dmp

Download

memory/4572-65-0x0000021986060000-0x0000021987068000-memory.dmp

Download

memory/4572-71-0x00007FF6D5760000-0x00007FF6D5785000-memory.dmp

Download

memory/4572-63-0x0000021986060000-0x0000021987068000-memory.dmp

Download

memory/4572-69-0x0000021986060000-0x0000021987068000-memory.dmp

Download

memory/4572-61-0x0000021986060000-0x0000021987068000-memory.dmp

Download

memory/4968-74-0x00007FF62E9B0000-0x00007FF62E9D1000-memory.dmp

Download

memory/4968-75-0x00007FF62E9B0000-0x00007FF62E9D1000-memory.dmp

Download

memory/4968-77-0x00007FF62E9B0000-0x00007FF62E9D1000-memory.dmp

Download