Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 20:33
Static task
static1
Behavioral task
behavioral1
Sample
Solara.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Solara.zip
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Launcher.bat
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
Launcher.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
log
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
log
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
lua51.dll
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
lua51.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
luajit.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
luajit.exe
Resource
win10v2004-20240426-en
General
-
Target
lua51.dll
-
Size
592KB
-
MD5
3dff7448b43fcfb4dc65e0040b0ffb88
-
SHA1
583cdab08519d99f49234965ffd07688ccf52c56
-
SHA256
ff976f6e965e3793e278fa9bf5e80b9b226a0b3932b9da764bffc8e41e6cdb60
-
SHA512
cdcbe0ec9ddd6b605161e3c30ce3de721f1333fce85985e88928086b1578435dc67373c3dc3492ed8eae0d63987cac633aa4099b205989dcbb91cbbfc8f6a394
-
SSDEEP
12288:rs7/mj/73RaLHIW5BmUeUhoE4RgiF1q1bPIBKsg4Db0S:rc/u/7IoRnUKfq1Dl4DY
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2972 2184 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2728 wrote to memory of 2184 2728 rundll32.exe rundll32.exe PID 2728 wrote to memory of 2184 2728 rundll32.exe rundll32.exe PID 2728 wrote to memory of 2184 2728 rundll32.exe rundll32.exe PID 2728 wrote to memory of 2184 2728 rundll32.exe rundll32.exe PID 2728 wrote to memory of 2184 2728 rundll32.exe rundll32.exe PID 2728 wrote to memory of 2184 2728 rundll32.exe rundll32.exe PID 2728 wrote to memory of 2184 2728 rundll32.exe rundll32.exe PID 2184 wrote to memory of 2972 2184 rundll32.exe WerFault.exe PID 2184 wrote to memory of 2972 2184 rundll32.exe WerFault.exe PID 2184 wrote to memory of 2972 2184 rundll32.exe WerFault.exe PID 2184 wrote to memory of 2972 2184 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lua51.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lua51.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 2203⤵
- Program crash