98ac57ea92df0670e9322342afb93c297b3d3d81a62c860ac11b1768a92d2fa8

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 08:15

Target

Solara.exe
Size

131KB
MD5

95d337236886b2999241a9f30611a72c
SHA1

53ba2fd44892dd3c95b9597a690010ba4e55956d
SHA256

98ac57ea92df0670e9322342afb93c297b3d3d81a62c860ac11b1768a92d2fa8
SHA512

08fd57e3930f62e68ff0993b96f004e4db618f126f97877068e5b4e99ff547def22709e2b4f7fb50e87c3026f62d2c9fb0758fc4d13dc44cde00458fcae0cb2a
SSDEEP

3072:WdZyK6m+jMxMbb1lnOXrPXe7Yhq5Zg1ulbSouMOA:WdZyK6m+jMxMbnOXzWY0qNV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2832	2716	Solara.exe	30
PID 2716 wrote to memory of 2832	2716	Solara.exe	30
PID 2716 wrote to memory of 2832	2716	Solara.exe	30

C:\Users\Admin\AppData\Local\Temp\Solara.exe
"C:\Users\Admin\AppData\Local\Temp\Solara.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2716 -s 616
  2⤵
  PID:2832

memory/2716-0-0x000007FEF66F3000-0x000007FEF66F4000-memory.dmp

Filesize
4KB

Download
memory/2716-1-0x000000013F240000-0x000000013F264000-memory.dmp

Filesize
144KB

Download
memory/2716-2-0x000007FEF66F0000-0x000007FEF70DC000-memory.dmp

Filesize
9.9MB

Download
memory/2716-3-0x000007FEF66F3000-0x000007FEF66F4000-memory.dmp

Filesize
4KB

Download
memory/2716-4-0x000007FEF66F0000-0x000007FEF70DC000-memory.dmp

Filesize
9.9MB

Download