File name:

GoogleCrashHandler64.exe

Full analysis: https://app.any.run/tasks/76818e60-8fba-46cc-a221-0d1db87bf98c
Verdict: Malicious activity
Threats:

Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth.

Malware Trends Tracker     >>>
Analysis date: November 16, 2023, 18:51:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
miner
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

D922699A521B19F557B6B238A5BF38E9

SHA1:

7F50F0752FD802C06E209AEE29683FC75E9E2021

SHA256:

E2B5025F5CEDEF2A50B9FDD3F696C0A464B46E5CF465974F5960705E8631A938

SSDEEP:

393216:fFM7gafpzSPWN6em3DnY/dB/+I1QzaO/AhybLHeeZzLn8yDS8mrFm4Lj:NGAWNT67YVx3NO/Ah4LlbFmrFm4L

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • GoogleCrashHandler64.exe (PID: 2700)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • GoogleCrashHandler64.exe (PID: 2700)

    • Process drops legitimate windows executable

      • GoogleCrashHandler64.exe (PID: 2700)

    • Starts CMD.EXE for commands execution

      • GoogleCrashHandler64.exe (PID: 2700)

    • Executing commands from a ".bat" file

      • GoogleCrashHandler64.exe (PID: 2700)

    • Get information on the list of running processes

      • cmd.exe (PID: 2332)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2332)

    • Connects to unusual port

      • dlIhost.exe (PID: 284)

  • INFO

    • Checks supported languages

      • GoogleCrashHandler64.exe (PID: 2700)
      • dlIhost.exe (PID: 284)

    • Reads the computer name

      • GoogleCrashHandler64.exe (PID: 2700)
      • dlIhost.exe (PID: 284)

    • Create files in a temporary directory

      • GoogleCrashHandler64.exe (PID: 2700)

    • The executable file from the user directory is run by the CMD process

      • dlIhost.exe (PID: 284)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (38.3)
.exe | Win32 Executable (generic) (26.2)
.exe | Win16/32 Executable Delphi generic (12)
.exe | Generic Win/DOS Executable (11.6)
.exe | DOS Executable Generic (11.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:11:16 23:57:03+01:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 35840
InitializedDataSize: 19968
UninitializedDataSize: -
EntryPoint: 0x396e6c
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.3.36.311
ProductVersionNumber: 1.3.36.311
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Google LLC
FileDescription: Google Crash Handler
FileVersion: 1.3.36.311
InternalName: Google Update
LegalCopyright: Copyright 2018 Google LLC
OriginalFileName: GoogleUpdate.exe
ProductName: Google Update
ProductVersion: 1.3.36.311
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start googlecrashhandler64.exe no specs cmd.exe no specs tasklist.exe no specs findstr.exe no specs dlihost.exe

Process information

PID
CMD
Path
Indicators
Parent process
284"C:\Users\admin\AppData\Local\Temp\dlIhost.exe" -rigName "" -useSSL true -noColor true -noLog true -checkForUpdates false -autoUpdate false -silence 3 -webPassword pRLtro16CRlT*!BrosAf -watchdog true -sortPools true -algo autolykos -wallet 9fKJro9s9AZLuhJNKC6NC18e3KqZSuAA5m4NNPc8McAEypHRwcu -pool1 erg.2miners.com:8888 -pool2 us-erg.2miners.com:8888 -pool3 asia-erg.2miners.com:8888 -pool4 erg.2miners.com:18888 -pool5 us-erg.2miners.com:18888 -pool6 asia-erg.2miners.com:18888 -pool7 ergo-eu1.nanopool.org:10600 -pool8 ergo-eu2.nanopool.org:10600 -pool9 ergo-us-east1.nanopool.org:10600 -pool10 ergo-us-west1.nanopool.org:10600 -pool11 ergo-asia1.nanopool.org:10600 -pool12 ergo-jp1.nanopool.org:10600 -pool13 ergo-au1.nanopool.org:10600 -pool14 ergo-eu1.nanopool.org:10643 -pool15 ergo-eu2.nanopool.org:10643 -pool16 ergo-us-east1.nanopool.org:10643 -pool17 ergo-us-west1.nanopool.org:10643 -pool18 ergo-asia1.nanopool.org:10643 -pool19 ergo-jp1.nanopool.org:10643 -pool20 ergo-au1.nanopool.org:10643 -pool20 pool.woolypooly.com:3100 -pool21 pool.eu.woolypooly.com:3100 -pool22 pool.us.woolypooly.com:3100 -pool23 pool.ru.woolypooly.com:3100 -pool24 pool.zh.woolypooly.com:3100 -pool25 pool.sg.woolypooly.com:3100 -pool26 pool.au.woolypooly.com:3100 -pool27 pool.br.woolypooly.com:3100 -pool28 pool.ca.woolypooly.com:3100 -pool29 pool.tr.woolypooly.com:3100 -pool30 pool.woolypooly.com:3100 -algo heavyhash -wallet kaspa:qrla42tgh7mw794mhxzr520jjgekjf3rwqn8jngeae63x2yn05py7ykjaxrpy -pool1 kas.2miners.com:2020 -pool2 kas.2miners.com:12020 -pool3 us-kas.2miners.com:2020 -pool4 us-kas.2miners.com:12020 -pool5 asia-kas.2miners.com:2020 -pool6 asia-kas.2miners.com:12020 -pool7 eu1.kaspa-pool.org:4444 -pool8 eu1.kaspa-pool.org:5555 -pool9 us1.kaspa-pool.org:4444 -pool10 us1.kaspa-pool.org:5555 -pool11 asia1.kaspa-pool.org:4444 -pool12 asia1.kaspa-pool.org:5555 -pool13 br1.kaspa-pool.org:4444 -pool14 br1.kaspa-pool.org:5555 -pool15 pool.woolypooly.com:3112 -pool16 pool.eu.woolypooly.com:3112 -pool17 pool.us.woolypooly.com:3112 -pool18 pool.zh.woolypooly.com:3112 -pool19 pool.sg.woolypooly.com:3112 -pool20 pool.au.woolypooly.com:3112 -pool21 pool.br.woolypooly.com:3112 -pool22 pool.ca.woolypooly.com:3112 -pool23 pool.tr.woolypooly.com:3112C:\Users\admin\AppData\Local\Temp\dlIhost.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Runtime Broker
Exit code:
0
Version:
10.0.19041.546 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\dlihost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
572TASKLIST C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2092FINDSTR /I "dlIhost.exe"C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2332cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\2700DUBL.bat" "C:\Users\admin\AppData\Local\Temp\GoogleCrashHandler64.exe" "C:\Windows\SysWOW64\cmd.exe—GoogleCrashHandler64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2700"C:\Users\admin\AppData\Local\Temp\GoogleCrashHandler64.exe" C:\Users\admin\AppData\Local\Temp\GoogleCrashHandler64.exe—explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Crash Handler
Exit code:
0
Version:
1.3.36.311
Modules
Images
c:\users\admin\appdata\local\temp\googlecrashhandler64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
376
Read events
376
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2700GoogleCrashHandler64.exeC:\users\admin\appdata\local\temp\nvrtc64_120_0.dll —
MD5:—
SHA256:—
2700GoogleCrashHandler64.exeC:\users\admin\appdata\local\temp\dlIhost.exeexecutable
MD5:65387DC87C1134B63D9F0080E1409828
SHA256:94CCA7CEAEA9147901663E942D39CC85BF798043BB46C9CC39E29836507143B1
2700GoogleCrashHandler64.exeC:\users\admin\appdata\local\temp\service.dllexecutable
MD5:78DEB7B61086D62D892D1858B9C969C0
SHA256:0DC4B89F876076A72A689F552DDD5530CCF542873EEFBEB5D24F29E90D8928BC
2700GoogleCrashHandler64.exeC:\Users\admin\AppData\Local\Temp\2700DUBL.battext
MD5:608CFD78BCE5FA6733EDB36D9E24040B
SHA256:9A10DC491602FF872A4F0D4E35D9F9B565F43488B509A20BAD1A7AA7E114C32A
2700GoogleCrashHandler64.exeC:\users\admin\appdata\local\temp\nvrtc-builtins64_120.dllexecutable
MD5:36B2DC4DEFC21EE8C27F9138E78A4C0B
SHA256:95E6F9EAB834609E8C41606B9DA28CF9EE7F7449F58097A2C0E947E5C557189B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
76
DNS requests
27
Threats
7

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
284
dlIhost.exe
141.95.124.99:18888
erg.2miners.com
OVH SAS
FR
unknown
284
dlIhost.exe
51.15.39.52:10643
ergo-eu1.nanopool.org
Online S.a.s.
NL
unknown
284
dlIhost.exe
139.99.49.249:18888
asia-erg.2miners.com
OVH SAS
SG
unknown
284
dlIhost.exe
139.99.49.249:8888
asia-erg.2miners.com
OVH SAS
SG
unknown
284
dlIhost.exe
51.15.39.52:10600
ergo-eu1.nanopool.org
Online S.a.s.
NL
unknown

DNS requests

Domain
IP
Reputation
pool.woolypooly.com
  • 116.203.44.184
  • 78.47.18.128
unknown
asia-erg.2miners.com
  • 139.99.49.249
  • 51.79.229.232
unknown
ergo-asia1.nanopool.org
  • 139.99.102.73
  • 103.3.62.64
  • 139.99.101.232
  • 139.99.102.74
  • 139.99.102.72
  • 139.99.101.198
  • 172.104.165.191
  • 139.99.102.70
  • 139.99.101.197
  • 139.99.102.71
unknown
us-erg.2miners.com
  • 51.81.185.231
  • 15.204.14.229
unknown
pool.ru.woolypooly.com
  • 5.189.201.113
  • 31.184.204.140
unknown
ergo-eu1.nanopool.org
  • 51.15.39.52
  • 51.15.54.102
  • 46.105.31.147
  • 163.172.162.51
  • 163.172.191.122
  • 51.68.137.66
unknown
pool.us.woolypooly.com
  • 5.161.112.148
unknown
ergo-us-west1.nanopool.org
  • 149.28.212.250
  • 207.246.100.198
  • 45.32.71.82
  • 104.238.180.207
  • 45.76.65.223
  • 66.42.105.146
unknown
ergo-us-east1.nanopool.org
  • 144.217.14.139
  • 192.99.69.170
  • 144.217.14.109
  • 142.44.243.6
  • 142.44.242.100
unknown
ergo-eu2.nanopool.org
  • 51.15.61.114
  • 51.15.89.13
  • 163.172.171.111
  • 51.255.34.80
  • 152.228.216.245
  • 92.222.217.165
unknown

Threats

PID
Process
Class
Message
324
svchost.exe
Potential Corporate Privacy Violation
ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org)
324
svchost.exe
Potential Corporate Privacy Violation
ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org)
324
svchost.exe
Potential Corporate Privacy Violation
ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org)
324
svchost.exe
Potential Corporate Privacy Violation
ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org)
324
svchost.exe
Potential Corporate Privacy Violation
ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org)
324
svchost.exe
Potential Corporate Privacy Violation
ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org)
324
svchost.exe
Potential Corporate Privacy Violation
ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GoogleCrashHandler64.exe