8d43c698222164b663d8bcf46eaa82947a7df712984570472eb31f81bf167c9e

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 13:21

Target

SolaraV3.exe
Size

7.5MB
MD5

11b6557986da2fe9bb31dc3a72170d6f
SHA1

c6964f84ef1aa1e09d2db5a83f44819d6294d91f
SHA256

8d43c698222164b663d8bcf46eaa82947a7df712984570472eb31f81bf167c9e
SHA512

127fd53fc20dc9ec732198aed661698ce15da81e46df33c2894ea1646c205d94c89d4399b2be1b642c726fb910570bd6f7fa5d749683202673514121203a3f90
SSDEEP

196608:Lx8wLSurErvI9pWjg/Qc+4o673pNrabePNNrStMXWTNJe:uurEUWjZZ4dDLIeF1StYwNJe

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2388	SolaraV3.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x000500000001925d-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2388	1576	SolaraV3.exe	31
PID 1576 wrote to memory of 2388	1576	SolaraV3.exe	31
PID 1576 wrote to memory of 2388	1576	SolaraV3.exe	31

C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe
  "C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe"
  2⤵
  - Loads dropped DLL
  PID:2388

C:\Users\Admin\AppData\Local\Temp\_MEI15762\python312.dll

Filesize
1.7MB

MD5
eb02b8268d6ea28db0ea71bfe24b15d6

SHA1
86f723fcc4583d7d2bd59ca2749d4b3952cd65a5

SHA256
80222651a93099a906be55044024d32e93b841c83554359d6e605d50d11e2e70

SHA512
693bbc3c896ad3c6044c832597f946c778e6c6192def3d662803e330209ec1c68d8d33bd82978279ae66b264a892a366183dcef9a3a777e0a6ee450a928268e2

Download Submit
memory/2388-23-0x000007FEF5730000-0x000007FEF5DF5000-memory.dmp

Filesize
6.8MB

Download