da9098d4713d46c44b95758bdf17e3d2fa1633b3130c7be47b7111132dc051ff

Resubmissions

05/07/2024, 12:50

05/07/2024, 12:43

max time kernel
41s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 12:43

Target

SolaraB2/Solara/SolaraBootstrapper.exe
Size

797KB
MD5

36b62ba7d1b5e149a2c297f11e0417ee
SHA1

ce1b828476274375e632542c4842a6b002955603
SHA256

8353c5ace62fda6aba330fb3396e4aab11d7e0476f815666bd96a978724b9e0c
SHA512

fddec44631e7a800abf232648bbf417969cd5cc650f32c17b0cdc12a0a2afeb9a5dbf5c1f899bd2fa496bd22307bfc8d1237c94920fceafd84f47e13a6b98b94
SSDEEP

12288:n1mzgHpbzEu8AgpQojA1j855xU9pHIRxSNN:1mzgH385QojA1j855xSHI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5108	644	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
644	SolaraBootstrapper.exe
644	SolaraBootstrapper.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	644	SolaraBootstrapper.exe

C:\Users\Admin\AppData\Local\Temp\SolaraB2\Solara\SolaraBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraB2\Solara\SolaraBootstrapper.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 1436
  2⤵
  - Program crash
  PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 644 -ip 644
1⤵
PID:2096

memory/644-0-0x00000000753BE000-0x00000000753BF000-memory.dmp

Filesize
4KB

Download
memory/644-1-0x0000000000790000-0x000000000085E000-memory.dmp

Filesize
824KB

Download
memory/644-2-0x00000000056B0000-0x0000000005C54000-memory.dmp

Filesize
5.6MB

Download
memory/644-3-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download
memory/644-4-0x00000000753B0000-0x0000000075B60000-memory.dmp

Filesize
7.7MB

Download