File name:

updater.exe

Full analysis: https://app.any.run/tasks/39174899-7557-4e0a-9bd0-1b4dc2fd4e51
Verdict: Malicious activity
Analysis date: April 04, 2025, 16:19:57
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

D99ABF789624DC7D20497433A57DE510

SHA1:

DD4AA37FBE944CE74C8D426105915B5B065A26B3

SHA256:

BBE4ECDD3113DA52C808C9D919D1EB46C363129A61EB07A92BA18C467198D193

SSDEEP:

98304:9zIBYnMZlpyUfqsTjq9MLGTh31mFFLmbqNyE/4seWWVUTMpSIl5DIhtk4u4+IFHp:8xIO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • updater.exe (PID: 4268)

    • Known privilege escalation attack

      • dllhost.exe (PID: 4244)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • updater.exe (PID: 4268)

    • Executes application which crashes

      • rundll32.exe (PID: 1180)

  • INFO

    • Checks supported languages

      • updater.exe (PID: 4268)

    • The sample compiled with english language support

      • updater.exe (PID: 4268)

    • Reads the computer name

      • updater.exe (PID: 4268)

    • Create files in a temporary directory

      • updater.exe (PID: 4268)

    • The sample compiled with chinese language support

      • updater.exe (PID: 4268)

    • Reads the machine GUID from the registry

      • updater.exe (PID: 4268)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 4244)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 3156)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:08:11 15:02:23+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 3584512
InitializedDataSize: 1310720
UninitializedDataSize: -
EntryPoint: 0x1ca5c0
OSVersion: 10
ImageVersion: -
SubsystemVersion: 10
Subsystem: Windows GUI
FileVersionNumber: 129.0.6651.0
ProductVersionNumber: 129.0.6651.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Google LLC
FileDescription: GoogleUpdater (x86)
FileVersion: 129.0.6651.0
InternalName: updater_exe
LegalCopyright: Copyright 2024 Google LLC. All rights reserved.
OriginalFileName: updater.exe
ProductName: GoogleUpdater (x86)
ProductVersion: 129.0.6651.0
CompanyShortName: Google
ProductShortName: Chrome
LastChange: 1fee8392336d433471a03f97efee1a8eded6ccce-refs/branch-heads/6651@{#1}
OfficialBuild: 1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start updater.exe sppextcomobj.exe no specs slui.exe no specs CMSTPLUA rundll32.exe werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1180"C:\WINDOWS\system32\rundll32.exe" C:\Users\admin\AppData\Local\Temp\ArmouryAIOSDK.dll,freeBufferC:\Windows\SysWOW64\rundll32.exe
dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
3221225477
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2384C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
3156C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1180 -s 672C:\Windows\SysWOW64\WerFault.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4244C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
4268"C:\Users\admin\AppData\Local\Temp\updater.exe" C:\Users\admin\AppData\Local\Temp\updater.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
GoogleUpdater (x86)
Exit code:
0
Version:
129.0.6651.0
Modules
Images
c:\users\admin\appdata\local\temp\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6700"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
2 396
Read events
2 369
Write events
24
Delete events
3

Modification events

(PID) Process:(4244) dllhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(3156) WerFault.exeKey:\REGISTRY\A\{747aa2d6-91de-82c9-293a-bda5c6c44f9b}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(3156) WerFault.exeKey:\REGISTRY\A\{747aa2d6-91de-82c9-293a-bda5c6c44f9b}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(3156) WerFault.exeKey:\REGISTRY\A\{747aa2d6-91de-82c9-293a-bda5c6c44f9b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Operation:writeName:ProgramId
Value:
0000f519feec486de87ed73cb92d3cac802400000000
(PID) Process:(3156) WerFault.exeKey:\REGISTRY\A\{747aa2d6-91de-82c9-293a-bda5c6c44f9b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Operation:writeName:FileId
Value:
00006f317948fd881fc9ad25292f6d2c021ee9a82a85
(PID) Process:(3156) WerFault.exeKey:\REGISTRY\A\{747aa2d6-91de-82c9-293a-bda5c6c44f9b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Operation:writeName:LowerCaseLongPath
Value:
c:\windows\syswow64\rundll32.exe
(PID) Process:(3156) WerFault.exeKey:\REGISTRY\A\{747aa2d6-91de-82c9-293a-bda5c6c44f9b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Operation:writeName:LongPathHash
Value:
rundll32.exe|ccf370e740f0e788
(PID) Process:(3156) WerFault.exeKey:\REGISTRY\A\{747aa2d6-91de-82c9-293a-bda5c6c44f9b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Operation:writeName:Name
Value:
rundll32.exe
(PID) Process:(3156) WerFault.exeKey:\REGISTRY\A\{747aa2d6-91de-82c9-293a-bda5c6c44f9b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Operation:writeName:OriginalFileName
Value:
rundll32.exe
(PID) Process:(3156) WerFault.exeKey:\REGISTRY\A\{747aa2d6-91de-82c9-293a-bda5c6c44f9b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Operation:writeName:Publisher
Value:
microsoft corporation
Executable files
1
Suspicious files
4
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3156WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_93b43e9ba9b760923ea586445146c111f637369b_67c333ae_ee964127-ed6a-453e-9023-49ad0d266c11\Report.wer —
MD5:—
SHA256:—
4268updater.exeC:\Users\admin\AppData\Local\Temp\ArmouryAIOSDK.dllexecutable
MD5:675E2680E8505A1207BD8DD365E7AF98
SHA256:8941B1F6D8B6ED0DBC5E61421ABAD3F1634D01DB72DF4B38393877BD111F3552
3156WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERF6B7.tmp.WERInternalMetadata.xmlbinary
MD5:228E292C19BF5259E0924AF5ACF1B565
SHA256:EB302B91324DB0D1E160560068A07927336ADCA331713A22ABB6C8202DDD916F
3156WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERF5EB.tmp.dmpbinary
MD5:C0A460780FF08F4AFD7925ECD7A735F5
SHA256:C70C0BAE671A24ED40762A2239F9A651461BAD82B80674F5AE42E705A0D08A99
3156WerFault.exeC:\Windows\appcompat\Programs\Amcache.hvebinary
MD5:F9A80A0EF452D6AC188F14AA57026C72
SHA256:6EC33CC1E377D68D71AF69BBF365EE9A610B578BA78057332B4075FB60512C64
3156WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERF6E7.tmp.xmlxml
MD5:1591CCCA7F558688478E63181A9F1309
SHA256:E6AF86D13F9788EDD2CDF6D9EB59D1DEAC3EE1392969E497CB43A95E3F2415C9
3156WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\rundll32.exe.1180.dmpbinary
MD5:8C98D6D476790679A86982E3738D80F3
SHA256:E1DA338081EAF41B3180C22C9F177908A9FCAA471B7DB062A05B861D6EE1334C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
17
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5116
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5116
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5116
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
google.com
  • 142.250.186.142
whitelisted
login.live.com
  • 20.190.159.131
  • 20.190.159.129
  • 20.190.159.2
  • 20.190.159.71
  • 40.126.31.131
  • 40.126.31.0
  • 20.190.159.128
  • 20.190.159.68
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
updater.exe