6f722a19a4b6ce08194823f304f49d31b04fa5d9f609f5dde0ff63bbf307f040

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 23:58

Target

SolaraV3.exe
Size

7.5MB
MD5

031a05dc463314df4904b6aab7abb56d
SHA1

d98f758b0126cc2bbfc59d38b23f59ebc8e21c18
SHA256

6f722a19a4b6ce08194823f304f49d31b04fa5d9f609f5dde0ff63bbf307f040
SHA512

974fb85323cc907c327f46ccb0d8bd27348aa049dbfc7f4497906d2daf2dd87602a4f662d5a7a5040b21d833aff315a835b9d4ae11106581d8b0b3e549b7577f
SSDEEP

196608:Tp8wQurErvI9pWjg/Qc+4o673pNrabePNNrStMXWTNJb:IurEUWjZZ4dDLIeF1StYwNJb

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2568	SolaraV3.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019c36-21.dat	upx
behavioral1/memory/2568-23-0x000007FEF5600000-0x000007FEF5CC5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2568	2708	SolaraV3.exe	31
PID 2708 wrote to memory of 2568	2708	SolaraV3.exe	31
PID 2708 wrote to memory of 2568	2708	SolaraV3.exe	31

C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe
  "C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe"
  2⤵
  - Loads dropped DLL
  PID:2568

C:\Users\Admin\AppData\Local\Temp\_MEI27082\python312.dll

Filesize
1.7MB

MD5
eb02b8268d6ea28db0ea71bfe24b15d6

SHA1
86f723fcc4583d7d2bd59ca2749d4b3952cd65a5

SHA256
80222651a93099a906be55044024d32e93b841c83554359d6e605d50d11e2e70

SHA512
693bbc3c896ad3c6044c832597f946c778e6c6192def3d662803e330209ec1c68d8d33bd82978279ae66b264a892a366183dcef9a3a777e0a6ee450a928268e2

Download Submit
memory/2568-23-0x000007FEF5600000-0x000007FEF5CC5000-memory.dmp

Filesize
6.8MB

Download