2664862a4f87e91f92f17a26e6d0b0505db5a92720f2d7eb703e0f55a88eec3f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 13:10

Target

SolaraV4.exe
Size

5.9MB
MD5

e95c0515d1d3bf9c2a6e0b20ba1ebd98
SHA1

8ca53ae3b33df086bd12d7fb31ada294f699bf9d
SHA256

2664862a4f87e91f92f17a26e6d0b0505db5a92720f2d7eb703e0f55a88eec3f
SHA512

06b0513e21321ec3bf28b9ca8a5ab422e458fdf9a997c05cb3b3eeed0ca75d8f0586c0836cdf0c2d30f73937bda20a580e5903cc35238c4bc50cbffbb41ac705
SSDEEP

98304:i97mDSuXXOgRHtJQi9UWvGfqD8WOxfmjaa15uXaDvdCK/blzFS03iw7FwXR6nQek:ihmDZ5RHvUWvozWOxu9kXwvdbDlA03NE

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2016	SolaraV4.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x00060000000174ac-21.dat	upx
behavioral2/memory/2016-23-0x000007FEF5D50000-0x000007FEF61BA000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2016	1796	SolaraV4.exe	31
PID 1796 wrote to memory of 2016	1796	SolaraV4.exe	31
PID 1796 wrote to memory of 2016	1796	SolaraV4.exe	31

C:\Users\Admin\AppData\Local\Temp\SolaraV4.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraV4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Users\Admin\AppData\Local\Temp\SolaraV4.exe
  "C:\Users\Admin\AppData\Local\Temp\SolaraV4.exe"
  2⤵
  - Loads dropped DLL
  PID:2016

C:\Users\Admin\AppData\Local\Temp\_MEI17962\python310.dll

Filesize
1.4MB

MD5
b3ae142a88ff3760a852ba7facb901bc

SHA1
ad23e5f2f0cc6415086d8c8273c356d35fa4e3ee

SHA256
2291ce67c4be953a0b7c56d790b6cc8075ec8166b1b2e05d71f684c59fdd91a5

SHA512
3b60b8b7197079d629d01440ed78a589c6a18803cc63cdeac1382dc76201767f18190e694d2c1839a72f6318e39dba6217c48a130903f72e47fa1db504810c1c

Download Submit
memory/2016-23-0x000007FEF5D50000-0x000007FEF61BA000-memory.dmp

Filesize
4.4MB

Download