35662500e31d085d460b306293ac426efa47b97dae45f3778906076913944e31

Resubmissions

05/08/2024, 20:23

05/08/2024, 20:11

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 20:11

Target
SolaraBootstrapper.exe
Size 30.0MB
Sample240805-yyhtbs1blb
SHA256 35662500e31d085d460b306293ac426efa47b97dae45f3778906076913944e31
MD5 8def6d80db11ec36bdf5f86f6de3316b
SHA1 399fd854999b014a26818e09ba2a0f5a6ce9ff58
SHA512 6242f2854f9791af8c24c07f86a7f5816c781e1928e19759fda4e01d67a044b197e3f3215a957ca45a6561f7453cfa256a07f0bcb59534febd5afedc3e8a3230
SSDEEP 786432:Y9Z9OAQD7vD+szcY87WGhySW8MCNrZpC3dC:6vhQD7v/E7WGhySWINrZpq
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2440	SolaraBootstrapper.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001cbe5-1100.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2440	3016	SolaraBootstrapper.exe	30
PID 3016 wrote to memory of 2440	3016	SolaraBootstrapper.exe	30
PID 3016 wrote to memory of 2440	3016	SolaraBootstrapper.exe	30

C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
  2⤵
  - Loads dropped DLL
  PID:2440

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30162\python310.dll
Size 1.4MB
SHA256 ab3e996db016ba87004a3c4227313a86919ff6195eb4b03ac1ce523f126f2206
MD5 933b49da4d229294aad0c6a805ad2d71
SHA1 9828e3ce504151c2f933173ef810202d405510a4
SHA512 6023188f3b412dd12c2d4f3a8e279dcace945b6e24e1f6bbd4e49a5d2939528620ceb9a5f77b9a47d2d0454e472e2999240b81bed0239e7e400a4e25c96e1165
SSDEEP 24576:vmhx0O5yMVUEV51zVZ/7KqaI0jVSn/OCNYLfUehwHqDdt9OJzoCr2TAY/f+TNX59:vmT0OjUK51xZ/7s6GDwKDD9OJEwsAE2V
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2440-1102-0x000007FEF6420000-0x000007FEF688E000-memory.dmp

Download