d9013c1476387330999900f827778cdd65370dddb79c0683d0f932c9c81bb36a

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chrome.exe
Size 14.5MB
Sample260924-sv716aware
SHA256 d9013c1476387330999900f827778cdd65370dddb79c0683d0f932c9c81bb36a
MD5 b5cbc7352b02a1918d48c86ae9bea942
SHA1 75490af0b80bb9464df341a29989dc2321e0f696
SHA512 320415b1359feb33440ef0913c9a7538551e8cb81cf4f98239a3cdefb7658202c4cd592a30e2330a53c3f8a4352fce59f5c057927235a98ff3b3ca5d68246abd
SSDEEP 393216:5vuDm2gWP2JPJImj3J0yaqg3TP4To1H8LOI490:V72aPXbGqS8wLr0
TLSH
T18AE633B77BB70039E1344AB4509F97D096DBF457A21CBAEB1979C2643A3071E467C0D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
3808	gupdater.exe
3288	gupdater.exe
2164	gupdater.exe
5108	crashpad_handler.exe
4432	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2164	gupdater.exe
2164	gupdater.exe
2164	gupdater.exe
2164	gupdater.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe
5108	crashpad_handler.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 3808	2012	Chrome.exe	90
PID 3808 wrote to memory of 4092	3808	gupdater.exe	91
PID 2164 wrote to memory of 5108	2164	gupdater.exe	96
PID 2164 wrote to memory of 4432	2164	gupdater.exe	98
PID 5108 wrote to memory of 2000	5108	crashpad_handler.exe	99
PID 5108 wrote to memory of 4124	5108	crashpad_handler.exe	100
PID 5108 wrote to memory of 4928	5108	crashpad_handler.exe	101
PID 5108 wrote to memory of 3588	5108	crashpad_handler.exe	102
PID 5108 wrote to memory of 1264	5108	crashpad_handler.exe	103
PID 5108 wrote to memory of 6048	5108	crashpad_handler.exe	104
PID 5108 wrote to memory of 5964	5108	crashpad_handler.exe	105
PID 5108 wrote to memory of 3216	5108	crashpad_handler.exe	106
PID 5108 wrote to memory of 1808	5108	crashpad_handler.exe	107
PID 5108 wrote to memory of 2920	5108	crashpad_handler.exe	108
PID 5108 wrote to memory of 2716	5108	crashpad_handler.exe	109
PID 5108 wrote to memory of 4420	5108	crashpad_handler.exe	110
PID 5108 wrote to memory of 4424	5108	crashpad_handler.exe	111
PID 5108 wrote to memory of 4948	5108	crashpad_handler.exe	112
PID 5108 wrote to memory of 3028	5108	crashpad_handler.exe	113
PID 5108 wrote to memory of 680	5108	crashpad_handler.exe	114
PID 5108 wrote to memory of 2608	5108	crashpad_handler.exe	115
PID 5108 wrote to memory of 4104	5108	crashpad_handler.exe	116

C:\Users\Admin\AppData\Local\Temp\Chrome.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\ProgramData\Google\Update\hsmz6zq4\gupdater.exe
  "C:\ProgramData\Google\Update\hsmz6zq4\gupdater.exe" /install2
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\SYSTEM32\certutil.exe
    certutil -addstore Root "C:\Users\Admin\AppData\Local\Temp\gucert_tmp.cer"
    3⤵
    PID:4092

C:\ProgramData\Google\Update\hsmz6zq4\gupdater.exe
"C:\ProgramData\Google\Update\hsmz6zq4\gupdater.exe" /svc
1⤵
- Executes dropped EXE
PID:3288

C:\ProgramData\Google\Update\hsmz6zq4\gupdater.exe
"C:\ProgramData\Google\Update\hsmz6zq4\gupdater.exe" /svc
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2164
- C:\ProgramData\Google\Update\hsmz6zq4\crashpad_handler.exe
  "C:\ProgramData\Google\Update\hsmz6zq4\crashpad_handler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2000
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4124
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4928
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3588
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1264
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:6048
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5964
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3216
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1808
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2920
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2716
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4420
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4424
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4948
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3028
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:680
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2608
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4104
- C:\ProgramData\Google\Update\hsmz6zq4\chrome.exe
  "C:\ProgramData\Google\Update\hsmz6zq4\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1p4zspqfwvav4azyxgq3s3gzf2vsu8z6tch8f5r268kac57tt4azcq6jf0jx.ZBPJFCBQ
  2⤵
  - Executes dropped EXE
  PID:4432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

chrome.dll

Path C:\ProgramData\Google\Update\hsmz6zq4\chrome.dll
Size 251KB
SHA256 a713aa6571f10b3a01f886a6e51a30028d37406a218932197480fdc5aa6ee39a
MD5 15cc8ae21a9f90b21564e046e6eab319
SHA1 98e241f09da5b31bfd420c5d68224fee16d4f591
SHA512 b45c5060b0f79fd3c6349c87ddd090f4e71764e874c8bb0a5feca74613688fe26da7224494e9247787666de72c732f99c86ac8b582c831677c2e1c82830868a7
SSDEEP 6144:V93zEaxe/JFA2BPlJ4WaK8s11ytcUe1NeN9JFaoEu:VNEaxefA2Lh8s3Tel2u
TLSH
T1314423ADB252B57FCAAB143CE2568651FCB139E80CA52E34D414D1321A79A8D3F324DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\ProgramData\Google\Update\hsmz6zq4\chrome.exe
Size 112KB
SHA256 6aeb069e0bc493ae0989b9806d6bf88361f5ecb6a1c62bd5d907f0218b311dc8
MD5 71075c136f9d00f87fe2482840c00e6a
SHA1 0e656eb1fd9fae2d2594b0cf606070e5019a4534
SHA512 df0b1c610fc48881db16e67e89d5e49f4eb5e24a4b0125bd384a897fa4f2fa3069fd55550665ec427b87bf030ff3600cb3b94a8011d10207fae1a4a7990c71d9
SSDEEP 3072:AHrIfsDDUz7g+hUmFULwixPhyIoOJ4omwZdwg:oIfICaziDs6
TLSH
T1CDB35B0BF29360FCC28BC234959796B1FA717C2506356F3FA990E6353D31E106A5DE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashpad_handler.exe

Path C:\ProgramData\Google\Update\hsmz6zq4\crashpad_handler.exe
Size 99KB
SHA256 c2eee2173c1a71071aae869744aa808793edeeec783d2b9e9de4917ce710d3c9
MD5 745f8edc8987ce34fc78d483a11b35f7
SHA1 aeda738f80431750c55d239977104d07ffc25dfc
SHA512 f58fdda97ff3598ac20f0c4fd943f67073305fb5750ac19c038744871810a0725e9cee2b56b5ecd640072ee36a4673b3da42d96bcae27e15291520512241e488
SSDEEP 1536:/MeIydPURCheGx02zyLDg2SIbP6/HBOTFTfo5OJjleomwjVDBX07:/M1ohzGg2NP6Pi9o8J4omw5D107
TLSH
T1FEA31947F29364ECC257C13491979672FB31BC750535AF7FAAA0CA752D20D20AE2CE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gupdater.exe

Path C:\ProgramData\Google\Update\hsmz6zq4\gupdater.exe
Size 14.5MB
SHA256 d9013c1476387330999900f827778cdd65370dddb79c0683d0f932c9c81bb36a
MD5 b5cbc7352b02a1918d48c86ae9bea942
SHA1 75490af0b80bb9464df341a29989dc2321e0f696
SHA512 320415b1359feb33440ef0913c9a7538551e8cb81cf4f98239a3cdefb7658202c4cd592a30e2330a53c3f8a4352fce59f5c057927235a98ff3b3ca5d68246abd
SSDEEP 393216:5vuDm2gWP2JPJImj3J0yaqg3TP4To1H8LOI490:V72aPXbGqS8wLr0
TLSH
T18AE633B77BB70039E1344AB4509F97D096DBF457A21CBAEB1979C2643A3071E467C0D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gucert_tmp.cer

Path C:\Users\Admin\AppData\Local\Temp\gucert_tmp.cer
Size 757B
SHA256 f6f77531bb012e1ce9b407f3ba98a472a36a315a011136e7e992712e3d266eb9
MD5 54233c86c9d065b26e62dd2bcf217c2b
SHA1 9b33f8aadb1efbc497fa7a1833d53e9b56a7498f
SHA512 bd96a567b8fdca2dc22624364f99274e23a8ba1c80c3807a638f952a0e9bb920464d75efd09e175b0e73c11fafcab4e3e97354c1104902b2d2eea8ff23f46b8f
TLSH
T17D01757DAB34790F2B05D413718ED3172833E8F86CAC18575A3799D349116A05E88614
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2012-4-0x00007FF60E060000-0x00007FF60E074000-memory.dmp

Download

memory/2012-2-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/2012-1-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/2012-9-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/2012-40-0x00007FF60E060000-0x00007FF60E074000-memory.dmp

Download

memory/2012-0-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/2012-39-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/2164-42-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/2164-41-0x00007FF62F670000-0x00007FF62F684000-memory.dmp

Download

memory/2164-37-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/3288-33-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/3288-32-0x00007FF62F670000-0x00007FF62F684000-memory.dmp

Download

memory/3808-36-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/3808-38-0x00007FF62F670000-0x00007FF62F684000-memory.dmp

Download

memory/3808-8-0x00007FF62F670000-0x00007FF62F684000-memory.dmp

Download

memory/3808-7-0x0000000140000000-0x0000000140E6E000-memory.dmp

Download

memory/4432-56-0x00007FF659B50000-0x00007FF659B75000-memory.dmp

Download

memory/5108-59-0x00007FF6D7CF0000-0x00007FF6D7D11000-memory.dmp

Download