6668a04536186e2608a1ecefd7b631ba460f8f27891fee3e4a6cf5abc8946740

Analysis

max time kernel
58s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/07/2026, 12:17

Target
wreezeclientLoader.exe
Size 5.8MB
Sample260731-pgaxqasemb
SHA256 6668a04536186e2608a1ecefd7b631ba460f8f27891fee3e4a6cf5abc8946740
MD5 b0a2bdecd68609bee011de1e86e8a7bf
SHA1 6211a8ae44b13f4ff91d9d3d1238f8b18e11b12a
SHA512 ced33ff877c1431fcd44a1676aa8abe294e7620ea03877b8679083cdc3c3159557e5d279ca3fb1aad6695c7e2d5ebc156dc90d2d481ba2e122406aca83977298
SSDEEP 98304:XmteGpKb+sX1ZvbeeJZ/dJolTlPNs2PKToa1FptF07TMToigGdFpMndH259nQqwR:XKeGgCsXDjpf/dJolpPgToa10/MIGdFP
TLSH
T1B656338192D12EE9FE23A13E88618816CAB2787A1361C78F057452576F377A06C7FF53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Loads dropped DLL 3 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6140 wrote to memory of 2712	6140	wreezeclientLoader.exe	80

C:\Users\Admin\AppData\Local\Temp\wreezeclientLoader.exe
"C:\Users\Admin\AppData\Local\Temp\wreezeclientLoader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Users\Admin\AppData\Local\Temp\wreezeclientLoader.exe
  "C:\Users\Admin\AppData\Local\Temp\wreezeclientLoader.exe"
  2⤵
  - Loads dropped DLL
  PID:2712

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61402\VCRUNTIME140.dll
Size 93KB
SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
MD5 4a365ffdbde27954e768358f4a4ce82e
SHA1 a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA512 54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722
SSDEEP 1536:dkb0wrlWxdV4tyfa/PUFSAM/HQUucN2f0MFOqH+F3fecbTUEuvw:dWD4eUp+HQpcNg0MFnH+F3fecbTUED
TLSH
T123937C4A7BA442BBD06AC178C1E34A16F771B844873053CF13B54AAA5F63BE05E3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI61402\base_library.zip
Size 1008KB
SHA256 6d40dff9e4eedb663bc0f2af92640e5f79480522ff7bed3be1163c8dc707d32f
MD5 500e96e7f8a0b9c1be1c39793ab5e662
SHA1 3dce8d41bf0a703d6384ba0cc6210a056c88f904
SHA512 b843701b68abc3771b2f25a604ac9b2965615ac94c0b7262cec73b58854688dcb81506f12e0a66fba22c5f877eb8f07b005c03f921acb9bc56873a311920c810
SSDEEP 24576:fhidK9tosQNRs54PK4IMPVw59bfCEzX5nESWeR32iO:fhidK9tosQNRs54PK4IZ9BnjWUXO
TLSH
T1592518407AB16ED7FD0AF3B9402A861C4A2A9339DB49D103794FC35C3F4A3E41E75A99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python38.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61402\python38.dll
Size 4.0MB
SHA256 2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128
MD5 26ba25d468a778d37f1a24f4514d9814
SHA1 b64fe169690557656ede3ae50d3c5a197fea6013
SHA512 80471bfeeab279ce4adfb9ee1962597fb8e1886b861e31bdff1e3aa0df06d93afeb3a3398e9519bab7152d4bd7d88fa9b328a2d7eb50a91eb60fead268912080
SSDEEP 49152:7szv0pyfz43jjWo2tAfHkhPAXCZT8nyhhA2i2hLX5CSwkINazHO+MJnjPabxTdOF:7P/kuARjoNYH5MJubFiH
TLSH
T1EE167B32A79401A4DAB79476C5138706CBF2FC513B20E34A91A4BAD52F73BA316EF705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61402\ucrtbase.dll
Size 971KB
SHA256 ce2621719f1358508c2c33bcc1380d78a737ca20cd18c0ac89f38e1be788d9a2
MD5 bd8b198c3210b885fe516500306a4fcf
SHA1 28762cb66003587be1a59c2668d2300fce300c2d
SHA512 c32b6c083d3a7da01085718e5685e9a04034be91251c065794ceef1dfaaf6573fdd845cbc84e926ab3f510d295649cb6e497564fbe52cc79c053357c645c11a5
SSDEEP 24576:WHf1+A/Ef/YdeFC2et3zfDgF5P8mX9EYmxvSZX0ypmKWLS:WHfJ/Ef/ceFgzfsH9EZA
TLSH
T17E259E74FB6C06A5C17BE5BCCA5B550AE572340247709ACB03EA87B93E2B7E4163B311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download