43abf0007f712220af5a5339aace99fb68929652bcacee4779c2f432220a15c4 | Triage

Analysis

max time kernel
15s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 02:25

Sharing

Report Analysis Logs

General

Target

Solara.exe
Size

2.4MB
MD5

0deb8032eee2cfe15754044442b5bc28
SHA1

825e16d17ac482389804ff5f5f2165315411ab22
SHA256

80c7757f87925a24bc0e4225a753c2f3e3ce40ffc2c9d46f48581dab95a95f7c
SHA512

1abd0199a8cf036e5a122a860b067c3b2acdee4dc38c694a61c5b117d6de8ee775160e15ef0a8460a9fc8abc9e09b3ec1a9522aa26c4b8c92276dbbed22a2610
SSDEEP

49152:Mm3c8RgY8M2lBfNGy8Tt5nVzZTM3pyTsFmrLHch+HFNWSOxv5SOYb1QYH:V5y8Tt5rHsAbcg9Oxv5nS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1344	1048	Solara.exe	29
PID 1048 wrote to memory of 1344	1048	Solara.exe	29
PID 1048 wrote to memory of 1344	1048	Solara.exe	29

C:\Users\Admin\AppData\Local\Temp\Solara.exe
"C:\Users\Admin\AppData\Local\Temp\Solara.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1048 -s 28
  2⤵
  PID:1344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-0-0x000000013F4C0000-0x000000013F736000-memory.dmp

Filesize
2.5MB

Download