f1acfdfd143833db10a800956c9fe6582fed936955869a297e0b9390ea8525e2

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/10/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 4.3MB
Sample261021-2pjk2sys7m
SHA256 f1acfdfd143833db10a800956c9fe6582fed936955869a297e0b9390ea8525e2
MD5 7abb89a98cf77c64e793b62172eb7bb6
SHA1 0908e534f5216e740601c3ec9d74b0d50a76623e
SHA512 200df5f063a9539652c592a0634a758f0191bd26358a948ba4b0d6af364cc7bdb8bf89a99dea723d3f9e89be475bf9971a709f48275ac9d1778834035726b9e6
SSDEEP 24576:NHdDWjzVccAZdLGZp7QKiqmi+G0zNqQyS3VTK6UZYnU6v7PihVGQ:bWfXAb+xJ+G0J7lm6UZBSP9Q
TLSH
T1C4261219B35786DFC35B42306965A2A1FD1E9E6071488E3AD399E0FE3EB1D3E19C06D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1772	GoogleUpdate.exe

Executes dropped EXE 2 IoCs

pid	Process
4756	GoogleUpdate.exe
1772	GoogleUpdate.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4756	3368	file.exe	90
PID 3368 wrote to memory of 1772	3368	file.exe	91

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\ProgramData\Google\Update\GoogleUpdate.exe
  C:\ProgramData\Google\Update\GoogleUpdate.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\ProgramData\Google\Update\GoogleUpdate.exe
  "C:\ProgramData\Google\Update\GoogleUpdate.exe" -d "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdate.exe

Path C:\ProgramData\Google\Update\GoogleUpdate.exe
Size 1.3MB
SHA256 fdb5180f48dd427dffc095e69d625ffad94a5710ce6b6d629c200612c39852a5
MD5 0a153ff00902c93014c03a01e688e25e
SHA1 dfcf451069f612c375a878f689b39863efa5f290
SHA512 91528b573fdcedc31dd0087e75a5aa147d6fe5bce5eb2d5df2526f13f0da373942bdb8682606525aaaa226eae90ffd9a7ff7b4d85a0c028f48675311ea2c6ce5
SSDEEP 6144:tp7/l+NIE13zJP5L5weVMkNoLKWBxlh0x:tprl6Iu3No9/lh0x
TLSH
T1BC55B03EAB6380EEC29B8170659B66B1F839FE244050983E4354D5BC3FA7D5E5DE82C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1772-13-0x00007FF7E8B70000-0x00007FF7E8BDE000-memory.dmp

Download

memory/3368-2-0x00007FF71C950000-0x00007FF71CAD4000-memory.dmp

Download

memory/3368-8-0x00007FF71C950000-0x00007FF71CAD4000-memory.dmp

Download

memory/4756-12-0x00007FF7E8B70000-0x00007FF7E8BDE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads