8c71cfacf197154b374413226b495b2c23d66c4cc55974cb7af101c55c6b6639

Analysis

max time kernel
28s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/02/2025, 17:32

Target

solara.exe
Size

81.4MB
MD5

66977dcaab51f791a4996e070e260d35
SHA1

f7757d9e252ff0615ef3313473547368d2d0f742
SHA256

8c71cfacf197154b374413226b495b2c23d66c4cc55974cb7af101c55c6b6639
SHA512

430cb00143b6096a00e0ee72239b87fe7eaa8b2d115c745689ef3a7e59647a32b7126ee285cf35dec4dd422679c48b69317a2cc30fdcaa211cdcec0757e8016e
SSDEEP

1572864:ibVlApDDW6omDOkiqOv8im2AatzE7WxklKhWiY4MHHLeqPNLtDm3ZvDTqgB:ipADJomDOknOv8i3hJxkMTMHVLt0Zv

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2196	solara.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a4a-1264.dat	upx
behavioral1/memory/2196-1266-0x000007FEF5830000-0x000007FEF5C9A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2196	2680	solara.exe	30
PID 2680 wrote to memory of 2196	2680	solara.exe	30
PID 2680 wrote to memory of 2196	2680	solara.exe	30

C:\Users\Admin\AppData\Local\Temp\solara.exe
"C:\Users\Admin\AppData\Local\Temp\solara.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Users\Admin\AppData\Local\Temp\solara.exe
  "C:\Users\Admin\AppData\Local\Temp\solara.exe"
  2⤵
  - Loads dropped DLL
  PID:2196

C:\Users\Admin\AppData\Local\Temp\_MEI26802\python310.dll

Filesize
1.4MB

MD5
b3ae142a88ff3760a852ba7facb901bc

SHA1
ad23e5f2f0cc6415086d8c8273c356d35fa4e3ee

SHA256
2291ce67c4be953a0b7c56d790b6cc8075ec8166b1b2e05d71f684c59fdd91a5

SHA512
3b60b8b7197079d629d01440ed78a589c6a18803cc63cdeac1382dc76201767f18190e694d2c1839a72f6318e39dba6217c48a130903f72e47fa1db504810c1c

Download Submit
memory/2196-1266-0x000007FEF5830000-0x000007FEF5C9A000-memory.dmp

Filesize
4.4MB

Download