98ded059ef33a827b95d988c89b7fa631f52075bac3e7d64cfddd896704aa4fb

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 12:01

Target

SolaraV4.exe
Size

6.9MB
MD5

4f8fa56ad56915b56f0a37a4e0eae5f7
SHA1

c912179e247b6d74a99af35946263e278b996169
SHA256

98ded059ef33a827b95d988c89b7fa631f52075bac3e7d64cfddd896704aa4fb
SHA512

f58f128244304a4ae9d4509095b7b5c1a926937e35f062ab2393c4869cdf8b00bed9f6d4da1c4e2d16e3252dd66821682b7651b03eb9ecd05488d9848c2c88c9
SSDEEP

98304:WrN2zdbM+Q2y+RvAjOjFgFQlwq4Mjk+dBZtu9xTtwz/aer6/BbLqledV1BqD5uUo:WrNc/vGOjmFQR4MVGFtwLPNledV1Yno

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

SolaraV4.exe

pid process

2648 SolaraV4.exe

pid	process
2648	SolaraV4.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI30282\python311.dll	upx

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

SolaraV4.exe

pid process

2648 SolaraV4.exe

pid	process
2648	SolaraV4.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

SolaraV4.exe

description	pid	process	target process
PID 3028 wrote to memory of 2648	3028	SolaraV4.exe	SolaraV4.exe
PID 3028 wrote to memory of 2648	3028	SolaraV4.exe	SolaraV4.exe
PID 3028 wrote to memory of 2648	3028	SolaraV4.exe	SolaraV4.exe

C:\Users\Admin\AppData\Local\Temp\SolaraV4.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraV4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028

C:\Users\Admin\AppData\Local\Temp\_MEI30282\python311.dll
Filesize
1.6MB

MD5
9e985651962ccbccdf5220f6617b444f

SHA1
9238853fe1cff8a49c2c801644d6aa57ed1fe4d2

SHA256
3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e

SHA512
8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36

Download Submit
memory/2648-23-0x000007FEF5B80000-0x000007FEF6169000-memory.dmp

Filesize
5.9MB

Download