da9098d4713d46c44b95758bdf17e3d2fa1633b3130c7be47b7111132dc051ff

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 20:48

Target

SolaraB2/Solara/SolaraBootstrapper.exe
Size

797KB
MD5

36b62ba7d1b5e149a2c297f11e0417ee
SHA1

ce1b828476274375e632542c4842a6b002955603
SHA256

8353c5ace62fda6aba330fb3396e4aab11d7e0476f815666bd96a978724b9e0c
SHA512

fddec44631e7a800abf232648bbf417969cd5cc650f32c17b0cdc12a0a2afeb9a5dbf5c1f899bd2fa496bd22307bfc8d1237c94920fceafd84f47e13a6b98b94
SSDEEP

12288:n1mzgHpbzEu8AgpQojA1j855xU9pHIRxSNN:1mzgH385QojA1j855xSHI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2068	2660	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2660	SolaraBootstrapper.exe
2660	SolaraBootstrapper.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	SolaraBootstrapper.exe

C:\Users\Admin\AppData\Local\Temp\SolaraB2\Solara\SolaraBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraB2\Solara\SolaraBootstrapper.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 1440
  2⤵
  - Program crash
  PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2660 -ip 2660
1⤵
PID:1964

memory/2660-0-0x000000007464E000-0x000000007464F000-memory.dmp

Filesize
4KB

Download
memory/2660-1-0x0000000000B30000-0x0000000000BFE000-memory.dmp

Filesize
824KB

Download
memory/2660-2-0x0000000005A80000-0x0000000006024000-memory.dmp

Filesize
5.6MB

Download
memory/2660-3-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/2660-4-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download