cf4c92f7409e378c06c409d58ae4ee6db3e4b6a09ff6300daa321df08723c11d

Analysis

user interaction
yes
max time kernel
3s
max time network
5s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 22:40

Target
Soda.lol.exe
Size 8.3MB
Sample260802-2lmtasgp2v
SHA256 cf4c92f7409e378c06c409d58ae4ee6db3e4b6a09ff6300daa321df08723c11d
MD5 994abf20d80d9f211949e68a0a699840
SHA1 254e547f1e781574209f78ad39a240eee5f52aa1
SHA512 84c442a7f7fd42128aaabf6cfc2eaf13876f56602ba89475687aaff9ad4d0b043b2fcbcb8881d1be4edff8c718c9aabb399c584bababb15ca23b063bced09ecb
SSDEEP 98304:g7EgzCNTRE3gtgG4XVf+u+wcvu0pVST4k:g7EgzCNTRE3gtgG4XVGuXI144k
TLSH
T1CF96D4257B5B996CD19BC47482478A62492030DB0B39B9FF4498963C2F7EBF46F38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 4764	1868	Soda.lol.exe	88

C:\Users\Admin\AppData\Local\Temp\Soda.lol.exe
"C:\Users\Admin\AppData\Local\Temp\Soda.lol.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\system32\curl.exe
  "curl.exe" -s -f https://sodalol.online/version.txt
  2⤵
  PID:4764