da485f602448b5e9d1aeb7fffb94fb5515bb319476ecb6c9e159cef8d96bb46a

Analysis

max time kernel
394s
max time network
366s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 04:50

Target

New_Update.zip
Size

175.2MB
MD5

e8cac11146227444fe2ecb450245bee3
SHA1

a19bdc8c782da82f34ba2166e1ef47b3edd41ccf
SHA256

bd098eb28e97190966f71c19a1d9f5e3fe665329cdef521c321ef1ba63a64928
SHA512

58d2409bfa3dfa0e3581a16530e2fbf87508c9a4486e5884ca005bfa89370489ac870543d9fb97b9c3bea61f2e7628474ec81155503a034452c560dfefe3f075
SSDEEP

3145728:PEZR9BCohjY/J2JCiC2ZKbKIsFfsfgSwkJf7jLrjWKrpbT9XmT4BCohjY/J2JCie:PEZR5hjSJF2s25NsISxWKrZxwyhjSJFb

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Solara.exe

pid	Process
1032	Solara.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid	Process
2328	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

7zFM.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7zFM.exe

description	pid	Process	procid_target
PID 2328 wrote to memory of 1032	2328	7zFM.exe	32
PID 2328 wrote to memory of 1032	2328	7zFM.exe	32
PID 2328 wrote to memory of 1032	2328	7zFM.exe	32

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\New_Update.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Local\Temp\7zO819FCF4B\Solara.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO819FCF4B\Solara.exe"
  2⤵
  - Executes dropped EXE
  PID:1032

memory/1032-12-0x0000000000E10000-0x0000000001E10000-memory.dmp

Filesize
16.0MB

Download