0fc04f424076678bef9da96cf8a536a1f4f4a1465c0b7c4d5733176b602c647e

Analysis

user interaction
yes
max time kernel
10s
max time network
9s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
12/08/2026, 09:40

Target
Soda_lol.exe
Size 8.3MB
Sample260812-lnnklstdqd
SHA256 0fc04f424076678bef9da96cf8a536a1f4f4a1465c0b7c4d5733176b602c647e
MD5 a3b4d82e8619095c6f8213a9be436c4c
SHA1 e7a4ce5b1fbe5a5d9b9f7139b495b36ae7b6b4ec
SHA512 5145fcfec3463425c29547a1dcdc00f1c616932f8ecf19f1772cc16dd8790505c7e96ad00eba004b65fd94acb12831f3742008008380d6fe114d6b79aca9a421
SSDEEP 98304:u3OcnCFSyOMgR/7/gtmeasbxfzLv6gLDwjf:u3OcnCFSyOMgR/7/gweVxLXk
TLSH
T1C396D5257B5B996CD09BC47482478A62492030DB0B39A9FF4498963C3F7EBF56F38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 4656	1532	Soda_lol.exe	81

C:\Users\Admin\AppData\Local\Temp\Soda_lol.exe
"C:\Users\Admin\AppData\Local\Temp\Soda_lol.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\system32\curl.exe
  "curl.exe" -s -f https://sodalol.online/version.txt
  2⤵
  PID:4656