5914a096fd81f00620a24e3d9c41b54b96f0f866fbdb482707f5229d1ab2c737

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chrome.exe
Size 14.4MB
Sample260924-vpgm5axcmf
SHA256 5914a096fd81f00620a24e3d9c41b54b96f0f866fbdb482707f5229d1ab2c737
MD5 5d571801ee0c044d76cd5535752114a2
SHA1 c561bfb90c8274b9ba83807703e85bf8aa421f5c
SHA512 af2ac99a178bc6b31151814433fa8ccad0136cc72401dd00a10cb580a3a5c438b0793f80699495f3243f172c8e61f5c53c8c67ead16b5927cc55112760504eef
SSDEEP 393216:kys0NwIgT/tkcJsg8I7KFQFfmRBWGwGZOv35t3+F4EbUuI04k0I:7s0VgT/XF8CUUewdv33CqW0I
TLSH
T156E633C27CE3D5A8E0C476F07199172F4DF378BC6876088FEA92DA24D761C1679A21C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
2752	gupdater.exe
4600	gupdater.exe
1112	gupdater.exe
5068	crashpad_handler.exe
6136	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1112	gupdater.exe
1112	gupdater.exe
1112	gupdater.exe
1112	gupdater.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe
5068	crashpad_handler.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2752	4368	Chrome.exe	89
PID 2752 wrote to memory of 3032	2752	gupdater.exe	90
PID 1112 wrote to memory of 5068	1112	gupdater.exe	95
PID 1112 wrote to memory of 6136	1112	gupdater.exe	97
PID 5068 wrote to memory of 5528	5068	crashpad_handler.exe	98
PID 5068 wrote to memory of 4084	5068	crashpad_handler.exe	99
PID 5068 wrote to memory of 1320	5068	crashpad_handler.exe	100
PID 5068 wrote to memory of 5876	5068	crashpad_handler.exe	101
PID 5068 wrote to memory of 3728	5068	crashpad_handler.exe	102
PID 5068 wrote to memory of 2852	5068	crashpad_handler.exe	103
PID 5068 wrote to memory of 4248	5068	crashpad_handler.exe	104
PID 5068 wrote to memory of 4452	5068	crashpad_handler.exe	105
PID 5068 wrote to memory of 4500	5068	crashpad_handler.exe	106
PID 5068 wrote to memory of 3472	5068	crashpad_handler.exe	107
PID 5068 wrote to memory of 2336	5068	crashpad_handler.exe	108
PID 5068 wrote to memory of 2204	5068	crashpad_handler.exe	109
PID 5068 wrote to memory of 5636	5068	crashpad_handler.exe	110
PID 5068 wrote to memory of 5736	5068	crashpad_handler.exe	111
PID 5068 wrote to memory of 3436	5068	crashpad_handler.exe	112
PID 5068 wrote to memory of 612	5068	crashpad_handler.exe	113
PID 5068 wrote to memory of 876	5068	crashpad_handler.exe	114
PID 5068 wrote to memory of 5776	5068	crashpad_handler.exe	115
PID 5068 wrote to memory of 3248	5068	crashpad_handler.exe	116
PID 5068 wrote to memory of 5648	5068	crashpad_handler.exe	117
PID 5068 wrote to memory of 4212	5068	crashpad_handler.exe	118
PID 5068 wrote to memory of 2580	5068	crashpad_handler.exe	119
PID 5068 wrote to memory of 2960	5068	crashpad_handler.exe	120
PID 5068 wrote to memory of 3040	5068	crashpad_handler.exe	121
PID 5068 wrote to memory of 2816	5068	crashpad_handler.exe	122

C:\Users\Admin\AppData\Local\Temp\Chrome.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4368
- C:\ProgramData\Google\Update\onf4s8vy\gupdater.exe
  "C:\ProgramData\Google\Update\onf4s8vy\gupdater.exe" /install2
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SYSTEM32\certutil.exe
    certutil -addstore Root "C:\Users\Admin\AppData\Local\Temp\gucert_tmp.cer"
    3⤵
    PID:3032

C:\ProgramData\Google\Update\onf4s8vy\gupdater.exe
"C:\ProgramData\Google\Update\onf4s8vy\gupdater.exe" /svc
1⤵
- Executes dropped EXE
PID:4600

C:\ProgramData\Google\Update\onf4s8vy\gupdater.exe
"C:\ProgramData\Google\Update\onf4s8vy\gupdater.exe" /svc
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1112
- C:\ProgramData\Google\Update\onf4s8vy\crashpad_handler.exe
  "C:\ProgramData\Google\Update\onf4s8vy\crashpad_handler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5528
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4084
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1320
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5876
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3728
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2852
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4248
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4452
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4500
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3472
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2336
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2204
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5636
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5736
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3436
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:612
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:876
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5776
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3248
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5648
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4212
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2580
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2960
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3040
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2816
- C:\ProgramData\Google\Update\onf4s8vy\chrome.exe
  "C:\ProgramData\Google\Update\onf4s8vy\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1ppumvvwwskhqms04q3h3jlqd7rprr2qu8qklls623hn3mkmlrc38sagsswl.JGATYMDT
  2⤵
  - Executes dropped EXE
  PID:6136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

chrome.dll

Path C:\ProgramData\Google\Update\onf4s8vy\chrome.dll
Size 201KB
SHA256 3a8fbcd7e6dab76b399cf281c9329cca751d39ab3618cd06aaf91674874bf578
MD5 7a9097e0fbfad06398de110ccfb5b9e9
SHA1 31ecbd58ac937dd8b963b59e52360f89f734b1fa
SHA512 a399881518c129cff74fd022ca59ad0f08009f9972cba62f5b4d9313efe3b18734bc097a27319b715cce2103698988a980a7a29d58d49b30d2eb7774931b37ad
SSDEEP 3072:NHcekc5fEq87mOcLanNgDZH2sEMjWiatQrSWDQxHRqFISNHENw3Isdx:Bcvcpi7mJc+2/PLtCSnxHRqFItNWx
TLSH
T1D8141288F223F974D4C7837D51FBA6B5AC00BDC4982E8D2E67A0D1542C79EDC6E2B052
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\ProgramData\Google\Update\onf4s8vy\chrome.exe
Size 112KB
SHA256 cd91cb3bc90916c97b94e72e79ad053ba89fda41bc374695b8ab8ba8a83d4550
MD5 81003e6b960f9d6196ce726b70f5831c
SHA1 8b220ce7ba60528f7f147a0a69df8ba033d587ec
SHA512 4dd5684c5a38acdb24c14de0facec21927a6f35c98177c94fa6c83930e23905778f39bbeb142bff0d0a10197fce9952ec861ca239202956d014d5a9836ae828c
SSDEEP 3072:OHrIfsDDKzbgW3UmFULwixPhyIoOjcomQ8dwg:GIfI2azsDF6
TLSH
T1EFB35B0BF29360FCC28BC234959796B1FA717C2506356F3FA9A0E6353D31E106A5DE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashpad_handler.exe

Path C:\ProgramData\Google\Update\onf4s8vy\crashpad_handler.exe
Size 99KB
SHA256 57449247d1395e6626887199a69d336545f178ff20a4ee8c416c3e5d22ee224f
MD5 a419f8c7a405a684088399a25263c6fb
SHA1 7a3344fb66bc71f9088210e15c3a6f815e8aabe4
SHA512 859c05165c9214480830f25c00269011bbe23d18fc23295d953ff4b221d9409b3a0d5c5d4e666207cb55fb09b3f212840e029afc92c63f7962cbea935530987a
SSDEEP 1536:YMeIydPURChe0902zyrDgOCg9P6/HBOTFTfo5Un1eomQnSDBX07:YM1ozzmgOHP6Pi9oOcomQSD107
TLSH
T1B0A31907F29364ECC257C13491979672FB71BC750535AF7EAAE0CA752D20D20AE2CE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gupdater.exe

Path C:\ProgramData\Google\Update\onf4s8vy\gupdater.exe
Size 14.4MB
SHA256 5914a096fd81f00620a24e3d9c41b54b96f0f866fbdb482707f5229d1ab2c737
MD5 5d571801ee0c044d76cd5535752114a2
SHA1 c561bfb90c8274b9ba83807703e85bf8aa421f5c
SHA512 af2ac99a178bc6b31151814433fa8ccad0136cc72401dd00a10cb580a3a5c438b0793f80699495f3243f172c8e61f5c53c8c67ead16b5927cc55112760504eef
SSDEEP 393216:kys0NwIgT/tkcJsg8I7KFQFfmRBWGwGZOv35t3+F4EbUuI04k0I:7s0VgT/XF8CUUewdv33CqW0I
TLSH
T156E633C27CE3D5A8E0C476F07199172F4DF378BC6876088FEA92DA24D761C1679A21C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gucert_tmp.cer

Path C:\Users\Admin\AppData\Local\Temp\gucert_tmp.cer
Size 758B
SHA256 ddde83c6944a56f328170b7b9d66d2ba9c5ad0a6015508a1f985a3c1fd42a55d
MD5 8940149ed2e7194f54a357ae1ec8a0ba
SHA1 ee51cf955d999330a5946daf339ded8a1e32e9d6
SHA512 7a42a8dc64b361df42c67b1a5529a9abbeb5f295a3ec42840105b2308119554a6ce51830915f47832efd179081741128546768018cf741a2955712551e7707c5
TLSH
T1890170122B3D580EFE00CEF8328A1E267FB0A9C0D0646862B2322008D183BE71EC816C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1112-39-0x0000000140000000-0x0000000140E61000-memory.dmp

Download

memory/1112-45-0x0000000140000000-0x0000000140E61000-memory.dmp

Download

memory/1112-43-0x00007FF6A2AE0000-0x00007FF6A2AF4000-memory.dmp

Download

memory/2752-38-0x0000000140000000-0x0000000140E61000-memory.dmp

Download

memory/2752-8-0x00007FF6A2AE0000-0x00007FF6A2AF4000-memory.dmp

Download

memory/2752-12-0x0000000140000000-0x0000000140E61000-memory.dmp

Download

memory/2752-40-0x00007FF6A2AE0000-0x00007FF6A2AF4000-memory.dmp

Download

memory/4368-7-0x0000000140000000-0x0000000140E61000-memory.dmp

Download

memory/4368-42-0x00007FF6A5520000-0x00007FF6A5534000-memory.dmp

Download

memory/4368-41-0x0000000140000000-0x0000000140E61000-memory.dmp

Download

memory/4368-2-0x0000000140000000-0x0000000140E61000-memory.dmp

Download

memory/4368-4-0x00007FF6A5520000-0x00007FF6A5534000-memory.dmp

Download

memory/4368-0-0x0000000140000000-0x0000000140E61000-memory.dmp

Download

memory/4600-31-0x00007FF6A2AE0000-0x00007FF6A2AF4000-memory.dmp

Download

memory/4600-35-0x0000000140000000-0x0000000140E61000-memory.dmp

Download

memory/4600-30-0x0000000140000000-0x0000000140E61000-memory.dmp

Download

memory/5068-60-0x00007FF66E7A0000-0x00007FF66E7C1000-memory.dmp

Download

memory/5068-62-0x00007FF66E7A0000-0x00007FF66E7C1000-memory.dmp

Download

memory/6136-58-0x00007FF755270000-0x00007FF755295000-memory.dmp

Download