b8165568c11eabc56eb6f059fc02c64a7ae6e1ac6ab723abe76f99badc1ce293

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.0MB
Sample260710-dpeebsdw9v
SHA256 b8165568c11eabc56eb6f059fc02c64a7ae6e1ac6ab723abe76f99badc1ce293
MD5 fb2c1ff3b9fc5ac2e422ff889d2e5ad8
SHA1 5b1c8db8da4cdecbf22bd3d1e669e758bb4ea7e4
SHA512 191c0be9b988c41f7c29ad95b02da29825b1d836e56a4bf727eb032bdf1c257d6f43e187f9e88b4d0b02310ef9f30b9ff7cdd111aeffe213a0c181eea8e94a8b
SSDEEP 49152:5trVb1mWmnvHO4ZP6bRXgCleFFvnWSuRJiQ6wN2quEaKlqU/:+1GQC0jWSkJiQ6wUqu0F
TLSH
T1E295128FEA6907F5C93991BC44215312EAA8BC024F10EEEB29A53D765C57AFD1F39700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3740	WindowsHelper.exe
3384	WindowsHelper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 3740	3172	file.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe
  "C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe"
  2⤵
  - Executes dropped EXE
  PID:3740

C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe
C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe
1⤵
- Executes dropped EXE
PID:3384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsHelper.exe

Path C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe
Size 1.5MB
SHA256 6b1b8e7237d12f0b23b520694b55b7c8bba26bc66ce1f8bfaf326b78706c3fcb
MD5 6daa0bee1db4caf09b2465e6369ba188
SHA1 d905946624c8b7f0ecf6c4b856212b63353fb070
SHA512 f55b344117f2de5dcd17cb1514a8a2f178fc05232e550a84db1d1f47f06006ccf32b63f4efe5e4f70a605700e6d30ed027d58a895e5878b8c0ae93a2d6e674e5
SSDEEP 24576:pAZP+JXf4SJmn0tsx+dC7be/9hjpTtI6:pS+VflJuZ7be
TLSH
T11F65BF1FA79812D5D13A83BD84D58782F9A1B8054B20AECF115A19E92E57FFD0F3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download