d2308ce690cdcc2a36398b46275c093afb4cfb8360324516f331cde41b5280e3

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chrome.exe
Size 14.3MB
Sample260930-an98tsaf69
SHA256 d2308ce690cdcc2a36398b46275c093afb4cfb8360324516f331cde41b5280e3
MD5 bac9ba849e5f0de203e9c11363c15676
SHA1 72a663a9bb8da8505ab154401fba9e64347dcb52
SHA512 9b4a34f179fa42342f4497c3bce3c3d218a71904df877497f4dc6af6b1f3ba54d9d259502318b37abd9fe0083b42e41181140d8b6aa5bc9dd0743b6cab82c7b0
SSDEEP 393216:bgtsDjfCwjdVcC6IkI1Jy7Yukl4er794USdwZjffoOKQ:bmsDjHAIkMJy7der+US4fog
TLSH
T160E633E16AF16427ED87B4B4D40482613A504AB8437676C8A194E6AF4C3D60BCD3DFFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
4324	gupdater.exe
3060	gupdater.exe
3180	gupdater.exe
4696	crashpad_handler.exe
4980	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3180	gupdater.exe
3180	gupdater.exe
3180	gupdater.exe
3180	gupdater.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe
4696	crashpad_handler.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4324	4904	Chrome.exe	90
PID 4324 wrote to memory of 1144	4324	gupdater.exe	98
PID 3180 wrote to memory of 4696	3180	gupdater.exe	115
PID 3180 wrote to memory of 4980	3180	gupdater.exe	117
PID 4696 wrote to memory of 4920	4696	crashpad_handler.exe	118
PID 4696 wrote to memory of 5372	4696	crashpad_handler.exe	119
PID 4696 wrote to memory of 3056	4696	crashpad_handler.exe	120
PID 4696 wrote to memory of 5220	4696	crashpad_handler.exe	121
PID 4696 wrote to memory of 536	4696	crashpad_handler.exe	122
PID 4696 wrote to memory of 4804	4696	crashpad_handler.exe	123
PID 4696 wrote to memory of 3076	4696	crashpad_handler.exe	124
PID 4696 wrote to memory of 5964	4696	crashpad_handler.exe	125
PID 4696 wrote to memory of 1972	4696	crashpad_handler.exe	126
PID 4696 wrote to memory of 3536	4696	crashpad_handler.exe	127
PID 4696 wrote to memory of 1132	4696	crashpad_handler.exe	128
PID 4696 wrote to memory of 6024	4696	crashpad_handler.exe	129
PID 4696 wrote to memory of 3868	4696	crashpad_handler.exe	130
PID 4696 wrote to memory of 3672	4696	crashpad_handler.exe	134
PID 4696 wrote to memory of 4184	4696	crashpad_handler.exe	137
PID 4696 wrote to memory of 1572	4696	crashpad_handler.exe	138
PID 4696 wrote to memory of 6028	4696	crashpad_handler.exe	139
PID 4696 wrote to memory of 2276	4696	crashpad_handler.exe	140
PID 4696 wrote to memory of 1500	4696	crashpad_handler.exe	141
PID 4696 wrote to memory of 2180	4696	crashpad_handler.exe	142
PID 4696 wrote to memory of 1144	4696	crashpad_handler.exe	143
PID 4696 wrote to memory of 2204	4696	crashpad_handler.exe	144
PID 4696 wrote to memory of 4172	4696	crashpad_handler.exe	145
PID 4696 wrote to memory of 1072	4696	crashpad_handler.exe	146
PID 4696 wrote to memory of 3260	4696	crashpad_handler.exe	147
PID 4696 wrote to memory of 1744	4696	crashpad_handler.exe	148
PID 4696 wrote to memory of 4856	4696	crashpad_handler.exe	149
PID 4696 wrote to memory of 4716	4696	crashpad_handler.exe	150

C:\Users\Admin\AppData\Local\Temp\Chrome.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\ProgramData\Google\Update\pshkiugu\gupdater.exe
  "C:\ProgramData\Google\Update\pshkiugu\gupdater.exe" /install2
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SYSTEM32\certutil.exe
    certutil -addstore Root "C:\Users\Admin\AppData\Local\Temp\gucert_tmp.cer"
    3⤵
    PID:1144

C:\ProgramData\Google\Update\pshkiugu\gupdater.exe
"C:\ProgramData\Google\Update\pshkiugu\gupdater.exe" /svc
1⤵
- Executes dropped EXE
PID:3060

C:\ProgramData\Google\Update\pshkiugu\gupdater.exe
"C:\ProgramData\Google\Update\pshkiugu\gupdater.exe" /svc
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3180
- C:\ProgramData\Google\Update\pshkiugu\crashpad_handler.exe
  "C:\ProgramData\Google\Update\pshkiugu\crashpad_handler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4920
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5372
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3056
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5220
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:536
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4804
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3076
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5964
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1972
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3536
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1132
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:6024
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3868
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3672
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4184
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1572
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:6028
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2276
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1500
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2180
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1144
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2204
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4172
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1072
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3260
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1744
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4856
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4716
- C:\ProgramData\Google\Update\pshkiugu\chrome.exe
  "C:\ProgramData\Google\Update\pshkiugu\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1p4zspqfwvav4azyxgq3s3gzf2vsu8z6tch8f5r268kac57tt4azcq6jf0jx.VYPMRCYQ
  2⤵
  - Executes dropped EXE
  PID:4980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

chrome.dll

Path C:\ProgramData\Google\Update\pshkiugu\chrome.dll
Size 78KB
SHA256 777b50d4b27e43e5754e18da6445a891780f1527232a7ddc0ba73dccd8566041
MD5 3ff7da5d52bcfc8166a2eea8520ce993
SHA1 962fd3be07bd2d83599a17f010d8bb21f6132a9d
SHA512 998f2c2382cd68b17807ab67615bcd683c9d64c9fe579eefd2dce0634da936ac71ff914bbde4de095659d12e2e27050b13bbd45150e1af1ade5eaa47d1225430
SSDEEP 1536:TxjntGqLjyUakywcHA66L3DvAuK8Eu5n3kp+kO9ihAp8nJHa9KiZOpoRA:TRtZ/y1Dxu/NK8Eut2+kSCAiziZTi
TLSH
T1C873F18E32C6987FC09FC4BC91DB8A30A9B0B5453D3D3F2DC524C253586D899A7A8C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\ProgramData\Google\Update\pshkiugu\chrome.exe
Size 112KB
SHA256 57a762a8599a2ef02b1d70870ad3a6e8a69d39efd63b4180ff7f417cac44c9c5
MD5 e8cc7998f82b4404c03cabd28b98715f
SHA1 e08ee89b20bd71ea21c5930cb8b357ab605428a8
SHA512 23741723b45b541f7354f835d8ba896bc6bafaed2ee38bb420504f984bbf28e988872f5d4980d3c4d1d7545f3f943742c1f97526841b5349b686a756d5ef009b
SSDEEP 3072:kHrIfsDDUz7g+hUmFULwixPhyIoOI4omwZdwg:0IfICazDDs6
TLSH
T1CCB35B0BF29360FCC28BC234959796B1FA717C2506356F3FA990E6353D31E106A5DE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashpad_handler.exe

Path C:\ProgramData\Google\Update\pshkiugu\crashpad_handler.exe
Size 99KB
SHA256 4b314e71b5f2d3ff47d493c578792738cea0cbedf1ba209669c14abb99644585
MD5 0c0dc6bebca0f5fe2341750e8abc0ba2
SHA1 9d7090ed27c0d06674e3c287ae713cc2296a722b
SHA512 50e4db68e11b907b418e755ed5791c6fd104c3afc1aed7eaf95fef52e1ba554453a2a6d605d7cb6f2cbf8c660b0ea09e444a807cf3cae6d8fb3196c85f29d389
SSDEEP 1536:cMeIydPURCheGx02zyLDg2SIbP6/HBOTFTfo5OEjleomwjVDBX07:cM1ohzGg2NP6Pi9o8E4omw5D107
TLSH
T10DA31947F29364ECC257C13491979672FB31BC750535AF7FAAA0CA752D20D20AE2CE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gupdater.exe

Path C:\ProgramData\Google\Update\pshkiugu\gupdater.exe
Size 14.3MB
SHA256 d2308ce690cdcc2a36398b46275c093afb4cfb8360324516f331cde41b5280e3
MD5 bac9ba849e5f0de203e9c11363c15676
SHA1 72a663a9bb8da8505ab154401fba9e64347dcb52
SHA512 9b4a34f179fa42342f4497c3bce3c3d218a71904df877497f4dc6af6b1f3ba54d9d259502318b37abd9fe0083b42e41181140d8b6aa5bc9dd0743b6cab82c7b0
SSDEEP 393216:bgtsDjfCwjdVcC6IkI1Jy7Yukl4er794USdwZjffoOKQ:bmsDjHAIkMJy7der+US4fog
TLSH
T160E633E16AF16427ED87B4B4D40482613A504AB8437676C8A194E6AF4C3D60BCD3DFFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gucert_tmp.cer

Path C:\Users\Admin\AppData\Local\Temp\gucert_tmp.cer
Size 758B
SHA256 2dce8b2484fb7437c17af890b479988fac2ce5b8dff4823f2b0b2d3f8e5ea313
MD5 999ef191647c4a0dff52548a3f35522a
SHA1 2095e4d0a9993b635026d55f5dfe5eec12ae533b
SHA512 6f8c02b125f359f3328706c0a448378cb2215512a3441f60603f76c7477e6bac9415cdecfe68d1b5c579cbb156237c6d73d7c8dd430536cc9555975de9b4845a
TLSH
T1B801206E7F623112BE4A2C115AC9D3377DB4DE95B821BCC6322245E9EE212F14E0681C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3060-34-0x00007FF66B4C0000-0x00007FF66B4D4000-memory.dmp

Download

memory/3060-36-0x00007FF66B4C0000-0x00007FF66B4D4000-memory.dmp

Download

memory/3060-37-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/3180-42-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/3180-47-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/3180-46-0x00007FF66B4C0000-0x00007FF66B4D4000-memory.dmp

Download

memory/4324-15-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/4324-10-0x00007FF66B4C0000-0x00007FF66B4D4000-memory.dmp

Download

memory/4324-41-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/4324-43-0x00007FF66B4C0000-0x00007FF66B4D4000-memory.dmp

Download

memory/4696-76-0x00007FF6DC890000-0x00007FF6DC8B1000-memory.dmp

Download

memory/4696-74-0x00007FF6DC890000-0x00007FF6DC8B1000-memory.dmp

Download

memory/4904-0-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/4904-11-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/4904-7-0x00007FF71F480000-0x00007FF71F494000-memory.dmp

Download

memory/4904-1-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/4904-44-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/4904-45-0x00007FF71F480000-0x00007FF71F494000-memory.dmp

Download

memory/4980-64-0x000001E90F270000-0x000001E910278000-memory.dmp

Download

memory/4980-62-0x000001E90F270000-0x000001E910278000-memory.dmp

Download

memory/4980-65-0x000001E90F270000-0x000001E910278000-memory.dmp

Download

memory/4980-66-0x000001E90F270000-0x000001E910278000-memory.dmp

Download

memory/4980-72-0x00007FF64C860000-0x00007FF64C885000-memory.dmp

Download

memory/4980-68-0x000001E90F270000-0x000001E910278000-memory.dmp

Download

memory/4980-63-0x000001E90F270000-0x000001E910278000-memory.dmp

Download