64d9b9e36c682c8306bb3099211d6544e59bfb6df373eebc8851469c4ae50b19

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 05:09

Target
roulette-bridge-windows-amd64.exe
Size 8.9MB
Sample260731-ftdppsvand
SHA256 64d9b9e36c682c8306bb3099211d6544e59bfb6df373eebc8851469c4ae50b19
MD5 7e24fbeedd9d99a3c4400d5bf1b12c1b
SHA1 1ede0f46bbad563a08b5b9306a00ad6d653cb54c
SHA512 aba7b9ce50956289780e8c5f3c76fd147d74405f13ac052b6bbefd7e1ff0808565e761adbfff13b7cd25982f5631293cd7c7bb8b4cf93e61a4573fcc0e48d34c
SSDEEP 98304:CKgNnv3EZTGdKBgF8uUh56idR/LgV6PvIZbfwE++JuGmtt:CpwCV8vvjPvWuGm
TLSH
T124965B43F25291ECC16FC178835AA632FA757CCA09307EBF16E497312E65E905B1DB28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 4272	4632	roulette-bridge-windows-amd64.exe	90

C:\Users\Admin\AppData\Local\Temp\roulette-bridge-windows-amd64.exe
"C:\Users\Admin\AppData\Local\Temp\roulette-bridge-windows-amd64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\system32\hostname.exe
  "hostname" -I
  2⤵
  PID:4272