c69edb34a72da0d3854a953161f6e6334621ad91778760134a6a90e0baab51b4

Analysis

max time kernel
149s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 19:57

Target
$TEMP/helium_install/setup.exe
Size 5.5MB
Sample260817-ypbcwsycmd
SHA256 c69edb34a72da0d3854a953161f6e6334621ad91778760134a6a90e0baab51b4
MD5 9bfe135fb72520a69105e7602a729d9b
SHA1 50a2f9348e1029f0791dcb352f6ec6390f274ed4
SHA512 32f386b811892a157cad50b87c8f5979a6f3dc709b5a6e4eb73c064a6698d43b393cccdd3e4ffc224171db783a4a967a3a83ae182e5c9f673e123309ee4098a5
SSDEEP 49152:4CgiEe6qSSzGB6zR7x0nsToAi0dY534vQga10pWyY8u9v6yFcA2M28AR4fidjtP4:OPGUnX4EIXpIyey5LG6w9
TLSH
T19B465B53F2A511E8D06EC974CF6D91229A257C8A47F1A3EF29D436E11A31ED47B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\helium_installer.log	setup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 1228	3704	setup.exe	85

C:\Users\Admin\AppData\Local\Temp\$TEMP\helium_install\setup.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\helium_install\setup.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Users\Admin\AppData\Local\Temp\$TEMP\helium_install\setup.exe
  C:\Users\Admin\AppData\Local\Temp\$TEMP\helium_install\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\imput\Helium\User Data\Crashpad" --url=https://crash.helium.computer/crash --annotation=plat=Win64 --annotation=prod=Helium --annotation=ver=0.15.5.1 "--attachment=C:\Program Files\helium_installer.log" --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater_history.jsonl --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff6408acf08,0x7ff6408acf18,0x7ff6408acf28
  2⤵
  PID:1228