379d24f9014f75bb932c77c65f7d9508d456cba86ec45b22c542a035626140d1

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 13:59

Target

Solara.exe
Size

7.4MB
MD5

668d1db9a3a70c9ecf654475f3369485
SHA1

31819dd4a5948424b3aac16e99ded3839ad7a8c1
SHA256

379d24f9014f75bb932c77c65f7d9508d456cba86ec45b22c542a035626140d1
SHA512

a2bf16b8b092326372152758d1485893aa578540fa5997041a60e03a1f527ee8cf3a38221deecb9a0d1d27561c75948241a0e08c9270a924cd3b9cb4744306e6
SSDEEP

196608:RrCO0cDeKG4+Ljv+bhqNVoBKUh8mz4Iv9Plu1D7AL:0ieT4CL+9qz8/b4IzuRAL

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

Solara.exe

pid process

2896 Solara.exe

pid	process
2896	Solara.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI27322\python311.dll	upx
behavioral1/memory/2896-23-0x000007FEF61A0000-0x000007FEF6789000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Solara.exe

description	pid	process	target process
PID 2732 wrote to memory of 2896	2732	Solara.exe	Solara.exe
PID 2732 wrote to memory of 2896	2732	Solara.exe	Solara.exe
PID 2732 wrote to memory of 2896	2732	Solara.exe	Solara.exe

C:\Users\Admin\AppData\Local\Temp\Solara.exe
"C:\Users\Admin\AppData\Local\Temp\Solara.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2732

C:\Users\Admin\AppData\Local\Temp\Solara.exe
"C:\Users\Admin\AppData\Local\Temp\Solara.exe"
2⤵
- Loads dropped DLL
PID:2896

C:\Users\Admin\AppData\Local\Temp\_MEI27322\python311.dll
Filesize
1.6MB

MD5
0b66c50e563d74188a1e96d6617261e8

SHA1
cfd778b3794b4938e584078cbfac0747a8916d9e

SHA256
02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

SHA512
37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

Download Submit
memory/2896-23-0x000007FEF61A0000-0x000007FEF6789000-memory.dmp

Filesize
5.9MB

Download