ec710ba066a78e3faf19b9d9a589ace5540a6a31551dc977b533e7d67352f87b

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 03:58

Target

SolaraBootstrapper.exe
Size

798KB
MD5

baa81d6b98890ac06befe560d00be992
SHA1

b69769c15af3ff85ca16a4ee579ea7fd959179e9
SHA256

ec710ba066a78e3faf19b9d9a589ace5540a6a31551dc977b533e7d67352f87b
SHA512

ded06cff210a201a53670ab55078c4edfcc0c4137af04b1ad3966b69464ec717957508b341d5f5fef485679bdd841017c420a14217d9480181a03fcd9aaad7f1
SSDEEP

12288:PZZmz3HwnXFZ9RgoOojAojAbJaTGLLvlguxD:3mz3Hi9tOojAojAbdLL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2640	2176	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2176	SolaraBootstrapper.exe
2176	SolaraBootstrapper.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	SolaraBootstrapper.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2640	2176	SolaraBootstrapper.exe	29
PID 2176 wrote to memory of 2640	2176	SolaraBootstrapper.exe	29
PID 2176 wrote to memory of 2640	2176	SolaraBootstrapper.exe	29
PID 2176 wrote to memory of 2640	2176	SolaraBootstrapper.exe	29

C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 1000
  2⤵
  - Program crash
  PID:2640

memory/2176-0-0x000000007442E000-0x000000007442F000-memory.dmp

Filesize
4KB

Download
memory/2176-1-0x00000000010C0000-0x000000000118E000-memory.dmp

Filesize
824KB

Download
memory/2176-2-0x0000000074420000-0x0000000074B0E000-memory.dmp

Filesize
6.9MB

Download
memory/2176-3-0x000000007442E000-0x000000007442F000-memory.dmp

Filesize
4KB

Download
memory/2176-4-0x0000000074420000-0x0000000074B0E000-memory.dmp

Filesize
6.9MB

Download